The module generated events have 2 fields underevent, event. module which has the module name like apache and event.dataset which would look like apache.access. you could add equivalent fields to ur custom inputs or just set tags via Log input | Filebeat Reference [7.16] | Elastic.