Pass dissect results to next event

we use dissect to find some keys, can we pass those fields to the next events till the key will be overwritten?
our use case: log file structure contains a header and a body.
we need to dissect some values from the header and make sure those values are available for all body events later.
is that possible?

Not really with beats natively.

And via logstash?

Probably with logstash by using memcache or similar feature

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.