Sorry in advance if this is covered already elsewhere.
I have a nginx server that hosts multiple sites and want to set a custom field/unique identifier for the access/error logs from each site that go to separate files. Should I modify the nginx module directly or do I disable it and create an filebeat.input for each website's access and error logs? What would that look like in the appropriate config? I have the filebeat output going to logstash and currently have a filter there to parse the log data.
Thanks,
Al