对每一台机器上都装一个filebeat，然后都指向同一个logstash，这时不同的filebeat传输的数据过来，需要输出到不同的索引，
filebeat.prospectors:
- type: log
enabled: true
paths:
- /var/log/nginx-json/access.log
input_type: log
fields.document_type: nginx
fields.service: nginx
tags: ["nginx"]
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
output.logstash:
hosts: ["10.0.0.5:5044"]
output { if [fields][service] == "nginx"{ elasticsearch { hosts => ["http://localhost:9200"] index => "h5-nginx-%{+YYYY.MM.dd}" } } }
原文：https://www.cnblogs.com/lemon-le/p/13096166.html