Tags index with filebeat and logstash
<p>I use logstash-forwarder and logstash and create a dynamic index with tags with this configuration:</p>

<p>/etc/logstash/conf.d/10-output.conf</p>

<pre><code>output {
  elasticsearch {
    hosts =&gt; "localhost:9200"
    manage_template =&gt; false
    index =&gt; "logstash-%{tags}-%{+YYYY.MM.dd}"
  }
}
</code></pre>

<p>/etc/logstash-forwarder.conf</p>

<pre><code>"files": [
    {
      "paths": [
        "/var/log/httpd/ssl_access_log",
        "/var/log/httpd/ssl_error_log"
       ],
      "fields": { "type": "apache", "tags": "mytag" }
    },
</code></pre>

<p>The associated filebeat configuration is:</p>

<p>/etc/filebeat/filebeat.yml</p>

<pre><code>filebeat:
  prospectors:
    -
     paths:
       - /var/log/httpd/access_log
     input_type: log
     document_type: apache
     fields:
       tags: mytag
</code></pre>

<p>In Kibana, instead of <code>mytag</code> I see <code>beats_input_codec_plain_applied</code> on all of my indices.</p>