# Apache2 AND Nginx logs, store in same index or separate?

**URL:** <https://discuss.elastic.co/t/apache2-and-nginx-logs-store-in-same-index-or-separate/145069>\
**Category:** Elasticsearch\
**Created:** [August 19, 2018, 10:46pm UTC](https://discuss.elastic.co/t/apache2-and-nginx-logs-store-in-same-index-or-separate/145069 "2018-08-19T22:46:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lucasjkr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lucasjkr/32/34317_2.png) [@lucasjkr](https://discuss.elastic.co/u/lucasjkr)\
**Post date:** [August 19, 2018, 10:46pm UTC](https://discuss.elastic.co/t/apache2-and-nginx-logs-store-in-same-index-or-separate/145069/1 "2018-08-19T22:46:22Z")

</div>

I'm working on web monitoring for a couple different services, some servers are Apache2 based, and some are Nginx based. Trying to figure out how to store the different document types.

I'm thinking the proper route would be to normalize both types of incoming logs in Logstash and store the both in a single "webservers-\*" index. That would make for simpler reporting, monitoring and dashboards. If i needed apache2 specific reports or nginx reports, I could just query only against documents tagged as such.

But every time something seems dead obvious to me lately, it turns out I'm thinking about it wrong. Which is why I thought I'd ask here how you guys go about it?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 19, 2018, 11:46pm UTC](https://discuss.elastic.co/t/apache2-and-nginx-logs-store-in-same-index-or-separate/145069/2 "2018-08-19T23:46:53Z")

</div>

Depends on how similar the formats end up, but you probably could put them together.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2018, 11:46pm UTC](https://discuss.elastic.co/t/apache2-and-nginx-logs-store-in-same-index-or-separate/145069/3 "2018-09-16T23:46:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.