input { beats { port => 5044 } } filter { if "json" in [tags] { json { source => "message" target => "json" } } } output { elasticsearch { hosts => ["http://elastic.service:9200"] index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" #user => "elastic" #password => "changeme" } }