This looks like a good case for Ingest Actions. Ingest actions allows you to select data, filter it using regex or eval expressions and then set the index when the conditions are met. It's under settings -> Ingest actions ... View more