Let's say you have a cluster with application logs. And since multiple applications are sending data to the cluster they have different properties. For example, one application will send a log message in the "message" property while the other would send it in the "msg" property.
How should one configure the mapping to preserve those fields but also have the possibility to use a single "message" property for all applications?
I know there is a "copy_to" feature but is that the only option there is? Are there some other options?