Using 3.1.0, I am unable to filter by _index. I've also tried changing the configuration to point to my unique index name rather than using _all
Others have noticed this bug as well...
https://groups.google.com/forum/#!topic/logstash-users/HrWNIcOk0EI