Filebeat comes with and ILM policy... you can just edit to your purpose.. that is the easy part. I would do it through the UI.. the GET the policy afterwards so you can see what a wellformed ILM policy looks like..
Ohh cool that you got it working
Add those App Tags to filter on...
Then you can switch to seperate index name in a bit once you get it all going .. little change for your customer... depending on the volume...
You might find the like it... hey I can see /search the app log and front end log in the same search... oooo they did not think of that! 
.... i.e. the equivalent of log-* for every then just turn on / off tag filters.. not have to select different index patterns
Ok stepping away... keep moving! Good Thread!