update prod filebeat

prod-upgrade/elastic/filebeat.yaml

@@ -29,13 +29,13 @@ data:
     filebeat.inputs:
     - type: log
       paths:
-        - /data/app_logs/*/logstash/*.log
+        - /data/app_logs/*/*/logstash/*.log
       json.keys_under_root: true
       tags: ['json']
 
     #All data to indexed to Elasticsearch
     output.logstash:
-      hosts: ["logstash.base.svc:5044"]
+      hosts: ["log-app.beaconfireinc.com:30012"]
 
 ---
 apiVersion: apps/v1

prod-upgrade/elastic/logstash.yaml

@@ -18,12 +18,16 @@ data:
           source => "message"
         }   
       }   
+      mutate {
+        split => { "[log][file][path]" => "/" }
+        add_field => { "env" => "%{[log][file][path][3]}" }
+      }
     }  
 
     output {
       elasticsearch {
         hosts => ["http://10.2.0.12:30019"]
-        index => "prod-logback-beaconfire-%{+YYYY.MM.dd}"
+        index => "%{[env]}-logback-beaconfire-%{+YYYY.MM.dd}"
       }
     }
   logstash.yml: |-