早上好，
我们正在尝试使用Logstash从AWS s3收集日志。下面是Logstash.conf文件：

input {

  tcp {
    port => 5000
    codec => json
  }

  s3 {
    # Keys for user in prod env
    id => "prod" 
    access_key_id => "key1" 
    secret_access_key => "secretkey1"
    region => "eu-central-1"
    bucket => "buket1"
    prefix => "prefix1/"
    include_object_properties => true
  }

  s3 {
    # Keys for user in preprod env
    id => "preprod"
    access_key_id => "key2" 
    secret_access_key => "secretkey2"
    region => "eu-central-1"
    bucket => "bucket2"
    prefix => "prefix2/"
    include_object_properties => true
  }
  
}

filter {

  # Matching prod logs
  if [id] == "prod" {
    mutate {
      add_field => { "env" => "prod" }
    }
  }
  else if [id] == "preprod" {
    mutate {
      add_field => { "env" => "preprod" }
    }
  }

}

output {
  opensearch {
    hosts       => "https://osb-platform"
      user => "username"
      password => "password"
    index       => "4s-%{[env]}-logs-%{+YYYY.MM.dd}"
    ecs_compatibility => disabled
    ssl_certificate_verification => false
  }
}

正如您所看到的，我有来自两个不同环境的两个输入，我希望将来自不同环境的日志放在不同的索引上。这是通过对输入的id进行过滤来完成的，方法是根据env添加一个新字段。
正确收集日志，但未区分索引：在OpenSearch中，我可以看到一个名为4s-%{[env]}-logs-2022.05.30的索引，它似乎无法解析env变量。
你能帮帮我吗？
谢谢你，
卢卡