Logstash and Elastic versions: 5.6.9
We're currently taking messages from RabbitMQ using logstash and outputting them to Elasticsearch. We noticed some scenarios of 400 responses and have enabled Logstash dead letter to ensure messages are not lost.
We have a further input on the dead letter and output these messages back to RabbitMQ into a Dead Letter Exchange there. This makes it easy for us to replay the messages back should we figure out why we had the 400 and would have fixed it.
What we noticed is that the headers in the rabbitmq message originally sent were being dropped when they get to the output queue of rabbitmq after it passes through the dead letter system.
Is this something we are missing or is this expected behaviour?