filebeat自定义索引(不同的日志输出到不同的索引)

filebeat可以实现不同的日志（input）输出到不同的索引（index）

  # 向输出的每一条日志添加额外的信息，比如“level:debug”，方便后续对日志进行分组统计。
  # 默认情况下，会在输出信息的fields子目录下以指定的新增fields建立子目录，例如fields.level
  # 这个得意思就是会在es中多添加一个字段，格式为 "filelds":{"level":"debug"}
  #fields:
  #  level: debug

配置文件如下所示

# ============================== Filebeat inputs ===============================

filebeat.inputs:

- type: log

  # Change to true to enable this input configuration.
  enabled: true
  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    #- /var/log/*.log
    - D:\demo01\*.txt
  fields: 
    source: junxue01
    
- type: log
  enabled: true
  paths:
    - D:\demo02\*.txt
  fields: 
    source: junxue02
    
    
  #include_lines: ['^txt','^junxue']

# ============================== Filebeat modules ==============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

# ======================= Elasticsearch template setting =======================

setup.template.settings:
  index.number_of_shards: 1
  #index.codec: best_compression
  #_source.enabled: false

# 允许自动生成index模板
setup.template.enabled: true
# # 生成index模板时字段配置文件
setup.template.fields: fields.yml
# # 如果存在模块则覆盖
setup.template.overwrite: true
# # 生成index模板的名称
setup.template.name: "zheng_log" 
# # 生成index模板匹配的index格式       
setup.template.pattern: "zheng-*" 
setup.ilm.enabled: auto
# 这里一定要注意 会在alias后面自动添加-*
setup.ilm.rollover_alias: "park-ssm"
setup.ilm.pattern: "{now/d}"
# # 生成kibana中的index pattern，便于检索日志
#setup.dashboards.index: myfilebeat-7.0.0-*
#filebeat默认值为auto，创建的elasticsearch索引生命周期为50GB+30天。如果不改，可以不用设置
setup.ilm.enabled: false
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]
  index: "zheng-%{[fields.source]}-*"
  indices:
    - index: "zheng-junxue01-%{+yyyy.MM.dd}"
      when.equals: 
        fields: 
          source: "junxue01"
    - index: "zheng-junxue02-%{+yyyy.MM.dd}"
      when.equals:
        fields:
          source: "junxue02"

# ================================= Processors =================================

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

最终结果是
demo01内的日志信息输入到索引：“zheng-junxue01-日期”
demo02内的日志信息输入到索引：“zheng-junxue02-日期”

参考：
【1】Filebeat自定义索引 && 多output过滤：https://www.cnblogs.com/lemon-le/p/11932813.html