Replace rsyslog with Filebeat?

[pmercado (PM)]

Hi @ajhstn,

reading docs it looks possible.
Have you tried adding multiple syslog inputs?

can this help on using different indexes?

Change index per pipeline

I'm very new to elasticsearch, so I may be approaching this problem incorrectly. I've got a couple logs with different log formats. It's pretty easy to create a pipeline with a grok pattern for each, but I'd like to send each log type to a different index. I assume this is a common pattern. How do other folks handle this? Ideally I'd like to do this with just filebeat and elasticsearch.