I've ventured into creating such a Logstash filter for percolating events inside the Logstash pipeline. It runs very similarly to the elasticsearch
Logstash filter.
You can find it here
This filter supports percolation of ad-hoc and/or existing documents, e.g.
# percolates the event itself
percolate {
hosts => ["localhost:9200"]
index => "my_index"
type => "my_type"
}
# percolates the sub-structure available in event['my_field']
percolate {
hosts => ["localhost:9200"]
index => "my_index"
type => "my_type"
target => "my_field"
}
# percolates the existing document having the id as specified in the event id field
percolate {
hosts => ["localhost:9200"]
index => "my_index"
type => "my_type"
id => "%{id}"
}
More info at https://github.com/elastic/logstash/issues/2187#issuecomment-216760668