Создайте индекс на основе поля сообщения - appname

****Код Logstash.conf *******

входные данные {

    stdin{
        type => "stdin-type"
    }

file{
    type => "json"
    path => [ "C:/prod/*.log", "C:/prod/*/**.log"]
    start_position => "beginning"
    tags => "prod"
    }

file{
    type => "json"
    path => [ "C:/dev/*.log", "C:/dev/*/**.log"]
    start_position => "beginning"
    tags => "dev"
    }

}

фильтр {

     grok {
    match => {
    "message" => [ "%{JSON:payload_raw} "]
    }
        pattern_definitions => {
        "JSON" => "{.*$"}

}

json {
    source => "payload_raw"
    target => "payload"
    }


mutate {
    remove_field => [ "payload_raw","message" ]
        }


date {
    match => [ "[payload][datetime]", "yyyy-MM-dd HH:mm:ss,SSS" ]
    target => "@timestamp"
    }

}

вывод {

    stdout {
    codec => rubydebug
    }
    elasticsearch {
    hosts => ["localhost:9200"]
    index => "%{tags}-logs"
    }

}

Пример журнала

{дата и время":"2021-08-10 04:11:37,825","servername":"VM-0001","serverip":"(null)","process":"2404","thread":"4","level":"DEBUG","appname":"Dev-Email","page":"Program.cs"}