https://sueboy.blogspot.com/2018/11/elk60filebeatdocumenttype.html

filebeat.yml

  
- type: log  
  paths:  
    - /var/log/geth.log  
  exclude_files: ['.gz$']  
  
  fields:  
    srctype: "geth"

pipleline logstah.conf

if [fields][srctype] == “geth” {

BUT fields_under_root: true 

  
- type: log  
  paths:  
    - /var/log/geth.log  
  exclude_files: ['.gz$']  
  
  fields:  
    srctype: "geth"  
  fields_under_root: true

if [srctype] == “geth” {