Logstash - change value of field in cloned document (logstash-clone filter plugin)

Question

Logstash 7.8.1

I'm trying to create two documents from one input with logstash. Different templates, different output indexes. Everything worked fine until I tried to change value only on the cloned doc. I need to have one field in both documents with different values - is it possible with clone filter plugin?

Doc A - [test][event]- trn

Doc B (cloned doc) - [test][event]- spn

I thought that it will work if I use remove_field and next add_field in clone plugin, but I'm afraid that there was problem with sorting - maybe remove_field method is called after add_field (the field was only removed, but not added with new value).

Next I tried to add value to cloned document first and than to original, but it always made an array with both values (orig and cloned) and I need to have only one value in that field:/. Can someone help me please?

Config:

input {

 file {
        path => "/opt/test.log"
        start_position => beginning
    }
}



filter {
  grok {
    match => {"message" => "... grok...."
       }
  }

mutate {
add_field => {"[test][event]" => "trn"}
}

clone {  
clones => ["cloned"] 
#remove_field => [ "[test][event]" ]  #remove the field completely
add_field => {"[test][event]" => "spn"}   #not added 
add_tag => [ "spn" ]
 }

}

output {
if "spn" in [tags] {
 elasticsearch {
    index => "spn-%{+yyyy.MM}"
    hosts => ["localhost:9200"]
    template_name => "templ1"
   }
  stdout { codec => rubydebug }
} else {
  elasticsearch {
    index => "trn-%{+yyyy.MM}"
    hosts => ["localhost:9200"]
    template_name => "templ2"
   }
  stdout { codec => rubydebug }
}
}

Answer 1

If you want to make the field that is added conditional on whether the event is the clone or the original then check the [type] field.

    clone {  clones => ["cloned"] }
    if [type] == "cloned" {
        mutate { add_field => { "foo" => "spn" } }
    } else {
        mutate { add_field => { "foo" => "trn" } }
    }

add_field is always done before remove_field.