娃哈哈好喝应用场景：
有些服务器运行多个微服务，而filebeat里面的配置要针对每个微服务分开配置，示例如下
filebeat配置：
filebeat.inputs:
- input_type: tcp
enabled: true
max_message_size: 20MiB
host: "0.0.0.0:9000"
max_connections: 0
fields:
service: "player"
service: "data"
fields_under_root: true
output.logstash:
hosts: ["172.20.21.81:55043"]
logstash的output配置
filter {
json {
source => "message" #要解析的字段名
target => "saas" #解析后的存储字段，默认和message同级别
remove_field => ["message"]
}
}
output {
elasticsearch {
action => "index"
hosts => ["http://127.0.0.1:9200"]
index => "logstash-%{[saas][serviceName]}-%{+YYYYMMdd}"
user => "elastic"
password => "yourpassword"
}
}