elasticsearch - Logstash: create new event in filter -
when filtering events in logstash (20+ attributes) create new event have 1 parameter original event , store other elastisearch index. i know possible using clone filter plugin. don't want manually remove attributes original events except 1 need. also clone event (i'm store new event in separate elasticsearch index) duplicate unneeded attributes. is there filter plugin purpose? or hidden feature? or maybe clone filter plugin handles removal of attributes cloned messages? elastalert simple framework alerting on anomalies, spikes, or other patterns of interest data in elasticsearch. http://elastalert.readthedocs.io/en/latest/elastalert.html