Hello && welcome!!
One of my old posts here (my first post on the question) was related to ignoring messages at the filebeat side for windows so they wouldn’t be shipped to Graylog… but incidentally it also shows using filebeat for multiple files. The only difference really is changing the paths to be linux-ish.
Hope that helps!