Missing instructions about different indices when using logstash output

[JCMais]

Following the format the data is sent when using the elasticsearch output directly, as seen here:

https://github.com/elastic/apm-server/blob/6.5/apm-server.yml#L409-L431

The docs for the logstash output are not correct: https://www.elastic.co/guide/en/apm/server/current/logstash-output.html

There is no message saying that it should forward the data based on the process.event value.

Here is a logstash.conf that takes that into consideration, and works for other beats components:

input {
  beats {
    port => 5044
  }
}

filter {
  if [@metadata][beat] == "apm-server" {
    if [processor][event] == "sourcemap" {
      mutate { add_field => { "[@metadata][index]" => "apm-%{[@metadata][version]}-sourcemap" } }
    } else {
      mutate { add_field => { "[@metadata][index]" => "apm-%{[@metadata][version]}-%{[processor][event]}-%{+yyyy.MM.dd}" } }
    }
  } else {
    mutate { add_field => { "[@metadata][index]" => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } }
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "%{[@metadata][index]}"
  }
}

[alvarolobato]

Related to: #1792