That could be a solution. However I'm not in control of LogStash. I work in a fairly large company and each team has certain responsibilities. LogStash is a service from another team. So I'd rather solve this within a Filebeat configuration (if possible).