How to pull a field from an event to another event?

This probably comes to you too late to be of any use, but you can do it with class variables, if you're careful. There is a tradeoff: you will have to settle on only ONE worker in your logstash to avoid problems.

Here is a thread on how I did it:

Good luck -