［求助］filebeat->logstash->es,不同的来源的日志，logstash解释生成不同的index

elkstack架构构如下图所示，
1)［需求］3个业务系统（svr_sys1、svr_sys2、svr_sys3）,在es中分别产生3个index，依次对应
      svr_sys1的索引为index_sys1、
     svr_sys2的索引为index_sys2、
     svr_sys3的索引为index_sys3


2)filebeat由业务系统导入logstah，通过document_type参数据指定，配置信息如下所示

• srv_sys1

#=========================== Filebeat prospectors =============================

filebeat.prospectors:



- input_type: log



  # Paths that should be crawled and fetched. Glob based paths.

  paths:

    - /srv/logs/*.log

    document_type: srv_sys1



#----------------------------- Logstash output --------------------------------

output.logstash:

  # The Logstash hosts

  hosts: ["10.20.20.50:5044"]

• srv_sys2

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

- input_type: log

  paths:

    - /srv/logs/*.log

    document_type: srv_sys2

#----------------------------- Logstash output --------------------------------

output.logstash:

  # The Logstash hosts

  hosts: ["10.20.20.50:5044"]

• srv_sys3

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

- input_type: log

  paths:

    - /srv/logs/*.log

    document_type: srv_sys2

#----------------------------- Logstash output --------------------------------

output.logstash:

  # The Logstash hosts

  hosts: ["10.20.20.50:5044"]

3)logstash的.conf文件的outpout通过if语句判断生成不同的index,配置信息如下：

input {

	beats {

		port => 5044

	}

}



output{

	if [type] =="srv_sys1" {

		elasticsearh {

			hosts => ["60.70.80.190:9200","60.70.80.191:9200"]

			index => "index_sys1-%{+YYYY.MM.dd}"

			document_type => "log"

		}

	}

	if [type] =="srv_sys2" {

		elasticsearh {

			hosts => ["60.70.80.190:9200","60.70.80.191:9200"]

			index => "index_sys2-%{+YYYY.MM.dd}"

			document_type => "log"

		}

	}

	if [type] =="srv_sys3" {

		elasticsearh {

			hosts => ["60.70.80.190:9200","60.70.80.191:9200"]

			index => "index_sys3-%{+YYYY.MM.dd}"

			document_type => "log"

		}

	}

}

［问题］es 只能创建一个index：index_sys3,其他2个无法成功创建