我是logstash和filebeat的新手。我正在尝试为我的logstash示例设置多个配置文件。使用filebeat向logstash发送数据。即使我为这两个logstash配置文件创建了过滤器，我也会得到重复的数据。
Logstash配置文件-1：

input {
  beats {
    port => 5045
  }
}

filter {
   if [fields][env] == "prod" {
     grok {   match => { "message" => "%{LOGLEVEL:loglevel}] %{GREEDYDATA:message}$" }
     overwrite => [ "message" ]
     }
   }
}

output {
  stdout {
    codec => rubydebug
  }

  elasticsearch {
    hosts => ["https://172.17.0.2:9200"]
    index => "logstash-myapp-%{+YYYY.MM.dd}"
    user => "elastic"
    password => "password"
    ssl => true
    cacert => "/usr/share/logstash/certs/http_ca.crt"
  }
}

logstash配置文件-2

input {
  beats {
    port => 5044
  }
}

filter {
   if [fields][env] == "dev" {
     grok {   match => { "message" => "%{LOGLEVEL:loglevel}] %{GREEDYDATA:message}$" }
     overwrite => [ "message" ]
     }
   }
}

output {
  stdout {
    codec => rubydebug
  }

  elasticsearch {
    hosts => ["https://172.17.0.2:9200"]
    index => "logstash-myapp-%{+YYYY.MM.dd}"
    user => "elastic"
    password => "password"
    ssl => true
    cacert => "/usr/share/logstash/certs/http_ca.crt"
  }
}

日志文件内容：

[INFO] First Line
[INFO] Second Line
[INFO] Third Line

文件节拍配置：

filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - /root/data/logs/*.log
  fields:
    app: test
    env: dev

output.logstash:
  # The Logstash hosts
    hosts: ["172.17.0.4:5044"]

我知道，即使我们有多个配置文件，logstash也会根据所有配置文件中存在的所有过滤器处理每一行数据。因此，我们在每个配置文件中为"fields. env"放置了过滤器。我希望有3行被发送到Elasticsearch，因为"fields. env"是"dev"，但它发送了6行到Elasticsearch并复制了数据。请帮助。