I am trying to send logs from LOgstash A to Logstash B , and from logstash B to elasticsearch . My question is where do I have to filter the logs and add additional fields to the messages. In logstash A or Logsatsh B . Also Is there any good Grok constructor that you would advise. I am a new to the elk environment.