Coexistence with logstash-forwarder

Elastic Stack Beats
2

Use conditionals to select which output(s) to use. Presumably there is some field (perhaps [@metadata][beat] that's unique for Beats-generated events.

output {
  if [@metadata][beat] {
    elasticsearch {
      hosts => ["http://localhost:9200"]
      index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      document_type => "%{[@metadata][type]}"
    }
  } else {
    # non-Beats outputs
  }
}