How to raw logs to logstash default index and filtered log to another index

[magnusbaeck (Magnus Bäck)]

if ... {
  elasticsearch {
    index => "business"
    ...
  }
}
elasticsearch {
  ...
}

Replace the first ... with whatever condition that matches login activity.