What I want is, the event i get from the Beats by listening to the port 5044, to send a filtered version of the event to one output and send a differently filtered version to the other output.
That is the general question but specifically in my case one of the two outputs will get the whole event as it came from the Beats.
Any good strategies on how to implement this? I have heard of Clone filter but from what i have seen it just clones specific fields to a
type field in the original event! While i don't want any correlation between the two events that get to the output.