output {
  #Ciso ASA
  if [type] == "cisco-fw" {
    elasticsearch {
      hosts => ["***.***.***.***"]
      index => "asa-%{+YYYY.MM.dd}"
    }
  }

  #filebeat syslog, web-server, and authlog
  if [type] == "syslog" or "web-server" or "authlog" {
    elasticsearch {
      hosts => ["***.***.***.***"]
      sniffing => true
      manage_template => false
      index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
      document_type => "%{[@metadata][type]}"
    }
  }
}       #end