Not sure which of those issues you want to address, but I will assume you want to send different types of data to different indexes based on tags. There are two approaches. One is to use conditionals in the output section.
output {
if "somestring" in [tags] {
elasticsearch { "index" => "Foo" }
} else if "otherstring" in [tags] {
elasticsearch { "index" => "Bar" }
} else {
elasticsearch { "index" => "Baz" }
}
}
Another is to use conditionals to put the index name into a field
filter {
if "somestring" in [tags] {
mutate { add_field => { "[@metadata][indexPrefix]" => "Foo" } }
} else if "otherstring" in [tags] {
mutate { add_field => { "[@metadata][indexPrefix]" => "Bar" } }
} else {
mutate { add_field => { "[@metadata][indexPrefix]" => "Baz" } }
}
}
output {
elasticsearch { index => "%{[@metadata][indexPrefix]}-%{+YYYY.MM}" }
}