Is it possible to access cloned event to add some more fields to it later on

Hi All,

I have cloned an event and removed a field from it. Now I am wondering if I can later on access this cloned event in the logstash and add another field to it.

            clones => ["cloned"]
            add_tag => [ "cloned" ]
            remove_field => [ "baseXml" ]

Somehow I feel it is created and gets emitted with no chance of adding any field later.

You can access the cloned event without any problems, like you would do with any other event.

The cloned event will be inserted in your pipeline like a normal event and will be processed by your pipeline starting from the first filter after the clone filter that generated the event.

If you want to access just a cloned event you need to use a conditional based on the tag.

if "cloned" in [tags] {

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.