You should be able to use the clone filter3 to generate one event per output and format these differently.
Ah, forgot about clone. Yes, that's the way to go.
[...] but how do I tell Logstash to send the original event to 'orders' index while sending a copy of the event + custom fields to the 'orders_alt' index?
The filter's clones
option sets the type
field of the clone(s), so just add conditionals to selectively apply filters and send them to different outputs.
filter {
clone {
clones => ["cloned"]
}
if [type] == "cloned" {
# this filter
} else {
# that filter
}
}