Разделение логов по индексам в Filebeat

[Igor_Motov]

Output to multiple indexes straight from filebeat.yml?

you hardcoded the index name in your output to index1. It is the index setting which selects the index name to use. See index docs and indices docs. The index setting supports Format Strings. That is, you can use any field in the event to construct the index. e.g. filebeat.prospectors: - ... fields: type: "logs1" - ... fields: type: "logs2" setup.template.name: "index-%{[beat.version]}" setup.template.pattern: "index-%{[beat.version]}-*" output.elasticsearch: ... index: "…

Только этот пост старый, теперь prospectors завутся inputs. Остальное должно работать.