filebeat配置文件filebeat.yml新增字段配置：
- type: log
paths: /opt/logs/**/*-stdout.log
tags: ["icf"]
配置logstash根據(jù)tags值寫入指定的索引：
$ cat /etc/logstash/conf.d/icf_app_logs.conf
...
output {
if "icf" in [tags] {
elasticsearch {
hosts => ["http://10.2.110.104:9200"]
index => "icf-dev-applogs-%{+YYYY.MM.dd}"
}
}
}
