filebeat多路径保存到不同index

使用tag区分

#配置多个input并指定tag
filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /data/logs/xxx-xxx-decision/*.log
  tags: ["xxx-xxx-decision"]
- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /data/logs/system-manage/*.log
  tags: ["system-manage"]

# 根据tag保存到不同的Index
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["10.254.193.137:9200"]
  
  indices:
    - index: "epu-bid-decision-%{[agent.version]}-%{+yyyy.MM.dd}"
      when.contains:
        tags: "epu-bid-decision"
    - index: "system-manage-%{[agent.version]}-%{+yyyy.MM.dd}"
      when.contains:
        tags: "system-manage"
    - index: "epu-bid-evaluation-%{[agent.version]}-%{+yyyy.MM.dd}"
      when.contains:
        tags: "epu-bid-evaluation"
  # Protocol - either `http` (default) or `https`.
  #protocol: "https"
#

参考
filebeat设置多个路径配置