# Remove or nullify full\_message field after extractors are completed?

**URL:** <https://community.graylog.org/t/remove-or-nullify-full-message-field-after-extractors-are-completed/21741>\
**Category:** Graylog Central (peer support)\
**Created:** [November 12, 2021, 3:06am UTC](https://community.graylog.org/t/remove-or-nullify-full-message-field-after-extractors-are-completed/21741 "2021-11-12T03:06:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jtbis](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@jtbis](https://community.graylog.org/u/jtbis)\
**Post date:** [November 12, 2021, 3:06am UTC](https://community.graylog.org/t/remove-or-nullify-full-message-field-after-extractors-are-completed/21741/1 "2021-11-12T03:06:11Z")

</div>

I am ingesting logs from Windows Domain Controllers ([example full\_message](https://pastebin.com/WVsahWq7)), which are quite lengthy. I am using extractors to pull out the fields that I need, how can I remove or nullify the full\_message field safely without effecting the extractors?

I am starting to think that these long messages could be the cause of the performance issues in my [previous post](https://community.graylog.org/t/search-pages-loading-extremely-slowly-and-causing-browser-to-go-unresponsive/21740/4)

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [November 12, 2021, 11:51am UTC](https://community.graylog.org/t/remove-or-nullify-full-message-field-after-extractors-are-completed/21741/2 "2021-11-12T11:51:15Z")

</div>

You can drop the field in the pipeline as long as you make sure your pipeline processor comes after the message filter chain under system/configurations.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 26, 2021, 11:51am UTC](https://community.graylog.org/t/remove-or-nullify-full-message-field-after-extractors-are-completed/21741/3 "2021-11-26T11:51:53Z")

</div>

Closed on November 26, 2021, 11:51am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.