So I did a few web searches, as I’m not entirely familiar with what the raw events look like from filebeats. If I’m reading right, it looks like the events from filebeats contain an entry [log][file][path] that provides the filename that beats got the event from.
You could definitely match on that and then route as necessary.
Do you have an example of a raw message from beats? There might be other options upon which we could match and route.
Nate