# Create new event in logstash filter

**URL:** https://discuss.elastic.co/t/create-new-event-in-logstash-filter/24375
**Category:** Logstash
**Created:** [June 25, 2015, 8:09pm UTC](https://discuss.elastic.co/t/create-new-event-in-logstash-filter/24375 "2015-06-25T20:09:30Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Andrej\_Kurocenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrej_kurocenko/32/3478_2.png) [@Andrej\_Kurocenko](https://discuss.elastic.co/u/Andrej_Kurocenko)
#### Post date: [June 25, 2015, 8:09pm UTC](https://discuss.elastic.co/t/create-new-event-in-logstash-filter/24375/1 "2015-06-25T20:09:30Z")

</div>

Hello,

when processing particular events by filters i would like sometimes to create new event with one attribute same as in original event (and store this new event into other elastic search index for further terms lookup querying).

My idea is to create new event and add required field from original event.

Can it be done using some existing filters? I could use `clone` filter, but i don't want to manually delete tens of attributes from original event.

Thank you very much for help!

---

<div class="post-metadata">

### Author: ![jrgns](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jrgns/32/640_2.png) [@jrgns](https://discuss.elastic.co/u/jrgns)
#### Post date: [June 26, 2015, 5:02am UTC](https://discuss.elastic.co/t/create-new-event-in-logstash-filter/24375/2 "2015-06-26T05:02:36Z")

</div>

I've created a PR to add a keep option to the mutate filter. The idea is that instead of specifying fields to remove, you just specify the fields you'd like to keep. If you use the clone filter along with that, it should be relatively simple.

You can find it here: [https://github.com/logstash-plugins/logstash-filter-mutate/pull/9](https://github.com/logstash-plugins/logstash-filter-mutate/pull/9)

I've been trying to find out why it hasn't been merged yet.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:36am UTC](https://discuss.elastic.co/t/create-new-event-in-logstash-filter/24375/3 "2017-07-06T05:36:24Z")

</div>


