I spent a couple of days looking for a solution without luck.
I have a server with different domains hosted, also known as virtual host, running Apache2 as front server. Each domain has their own logs with a file directory structure like that:
/var/www/domain1.com/logs/access_ssl_log,
/var/www/domain2.com/logs/access_ssl_log
/var/www/domain3.com/logs/access_ssl_log
....
There is a way of have domain logs separated by indexes in Elasticsearch?
If you are ingesting the files with filebeat they will have the file name on every event. You can parse the domain name out of the path and use a sprintf reference for the index name.
That said, if this results in a large number of small indexes you may have performance problems.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.