Auditbeat and filebeat in same Index

Elastic Stack Beats
1

I want to send Auditbeat and filebeats logs in same index over Logstash. Filebeat is already successfully sending the data. But i dont know how i get Auditbeat logs in the same index because there is no output_type tag. I need the output_type for Logstash.

pls help

thx

2

Hello @Samau4ka, Why do you want to send data of metricbeat and filebeat to the same index?

3

Hi @pierhugues on my setup every server is a index. so i can separate them.

4

@Samau4ka I would not recommend having a different index per server, depending on the number of servers and the naming you are using it could generate a lot of shards on Elasticsearch.

If I were you I would keep a time-based index per beats and you can achieve the same thing by filtering on the beat.host or 'beat.hostname' field in kibana to get the information for a specific host. You can also add custom fields if you want more granularity. You can check our doc to see the default fields.