Split message by field to different outputs

Elastic Stack Logstash
1

I have udp input with json codec

my records looks like :

{
"id":"value",
"field1:"val",
"fieldN:"val",

details: {  big nested structure }
}

How can I split this message into

{
"id":"value",
"field1:"val",
"fieldN:"val",
}

and { big nested structure }
and push it into different outputs, first should go into elastic search and details should go into S3, ideally with key == id from main record

2

You can use the clone filter to split each event in two. Then you can apply different transforms on each copy of the message.