Logstash filter to include specific keys only

If you get time please check below query

I am seeing drop in log ingestion from cloudwatch plugin, few of the logs are missing at ELK but available in source (cloud watch)

logs are ingested at average rate 6 mil/hour

I couldn't figure out a way to get to root cause of it

thanks.