copy.conf

gistfile1.txt

input {
  elasticsearch {
   hosts => ["src:9200"]
   index => "index"
  docinfo => true
  size => 20
  }
}
filter {
 mutate {
  remove_field => [ "@version", "@timestamp" ]
 }
}
output {
 elasticsearch {
   hosts => ["dst:9200"]
   manage_template => false
   index => "index"
      document_id => "%{[@metadata][_id]}"

   workers => 1
 }
}

json export

input {
  elasticsearch {
   hosts => ["127.0.0.1:9242"]
   index => "honeytrap"
   query => '{"query": { "query_string": { "query": "category:udp AND destination-port:11211" }}}'
  docinfo => true
  size => 20
  }
}
filter{
 mutate {
  remove_field => [ "@version", "@timestamp" ]
 }
}
output {
    file {
codec => "json"
path => ["/tmp/11211_udp.json"]
   workers => 1
 }
}