I was cleaning up some code that I use to generate emails for alerts based on some criteria in Logstash.
These alerts send an email as well as create a new document for insertion into Elasticsearch. This gives a historial record of any alerts generated.
When I added some mutate lines to my Logstash config to remove the unused fields AFTER the email output but BEFORE the Elasticsearch output, the emails basically came across as blank.
All I am trying to do, is remove the extra fields before the log gets inserted into Elasticsearch. But it seems, that even though the remove fields config is AFTER the email output config everything breaks.
Am I missing something?