Thx for all it works fine !
For people which could have the same problem, this is my filebeat.yml conf :
filebeat.prospectors: - type: log enabled: true paths: - /home/log/malwarebytes/*.csv fields_under_root: true fields: filetype: malwarebytes - type: log paths: /home/log/ironport/*.csv fields_under_root: true fields: filetype: ironport
And then, I just merge my two pipelines into only one and I do the distinction into this one like that :
if [filetype] == "ironport"
{
elasticsearch
{
hosts => "http://localhost:9200"
index => "ironport-monitoring"
}
}
else if [filetype] == "malwarebytes"
{
elasticsearch
{
hosts => "http://localhost:9200"
index => "malwarebytes-report"
Thx @Badger