Is it possible to access cloned event to add some more fields to it later on

[pk.241011]

Hi All,

I have cloned an event and removed a field from it. Now I am wondering if I can later on access this cloned event in the logstash and add another field to it.

    clone
    {
            clones => ["cloned"]
            add_tag => [ "cloned" ]
            remove_field => [ "baseXml" ]
    }

Somehow I feel it is created and gets emitted with no chance of adding any field later.

[leandrojmp (Leandro Pereira)]

You can access the cloned event without any problems, like you would do with any other event.

The cloned event will be inserted in your pipeline like a normal event and will be processed by your pipeline starting from the first filter after the clone filter that generated the event.

If you want to access just a cloned event you need to use a conditional based on the tag.

if "cloned" in [tags] {
  filters
}