diff --git a/dev-upgrade/elastic/filebeat.yaml b/dev-upgrade/elastic/filebeat.yaml
index 47e2304..d6f768c 100644
--- a/dev-upgrade/elastic/filebeat.yaml
+++ b/dev-upgrade/elastic/filebeat.yaml
@@ -29,7 +29,7 @@ data:
     filebeat.inputs:
     - type: log
       paths:
-        - /data/app_logs/*/logstash/*.log
+        - /data/app_logs/*/*/logstash/*.log
       json.keys_under_root: true
       tags: ['json']
 
diff --git a/dev-upgrade/elastic/logstash.yml b/dev-upgrade/elastic/logstash.yml
index 2c97ec4..d4da17f 100644
--- a/dev-upgrade/elastic/logstash.yml
+++ b/dev-upgrade/elastic/logstash.yml
@@ -16,13 +16,17 @@ data:
           source => "message"
         }   
       }   
+      mutate {
+        split => { "log.file.path" => "/" }
+        add_field => { "env" => "%{[hostlog.file.path][2]}" }
+      }
     }  
 
     output {
       stdout { codec => rubydebug }
       elasticsearch {
         hosts => ["http://elastic:9200"]
-        index => "dev-logback-beaconfire-%{+YYYY.MM.dd}"
+        index => "%{[env]}-logback-beaconfire-%{+YYYY.MM.dd}"
       }
     }
   logstash.yml: |-