Not sure to fully understand the "blunt" field and mutate sequence of operations but @jordansissel wouldn't it be nice to qualify the event getting in Logstash as soon as possible, meaning adding type, source_host, source ... to the event when arriving in the rabbitmq input, not waiting to do it in the filters.