# Best practice about index pattern definition

**URL:** <https://discuss.elastic.co/t/best-practice-about-index-pattern-definition/67156>\
**Category:** Kibana\
**Created:** [November 25, 2016, 6:26am UTC](https://discuss.elastic.co/t/best-practice-about-index-pattern-definition/67156 "2016-11-25T06:26:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Houss](https://avatars.discourse-cdn.com/v4/letter/h/a88e4f/32.png) [@Houss](https://discuss.elastic.co/u/Houss)\
**Post date:** [November 25, 2016, 6:26am UTC](https://discuss.elastic.co/t/best-practice-about-index-pattern-definition/67156/1 "2016-11-25T06:26:50Z")

</div>

Hello,

I am creating an index for each type of logs being sent to the elasticsearch cluster (there might be like 5-6 index patterns overall). The patterns look like this : _logstash-squid-%{+[YYYY.MM](http://YYYY.MM)}_, or _logstash-apache-%{+[YYYY.MM](http://YYYY.MM)}_, etc.

I was wondering what the best practice on kibana would be when adding a pattern. Is it better to just go with one logstash-\* for everything, then to add queries to filter the logs I want for the vizualisations, or should I add a pattern for each type of logs (e.g. logstash-squid-\*) ? Would that make the searches, queries, and dashboard loading faster ?

Thanks for the insights !

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 25, 2016, 7:16am UTC](https://discuss.elastic.co/t/best-practice-about-index-pattern-definition/67156/2 "2016-11-25T07:16:03Z")

</div>

Using `logstash-*` means you can view everything, which is useful. Or you can go for specific ones if you don't want people to see various log sets.

It depends on your needs really.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 23, 2016, 7:16am UTC](https://discuss.elastic.co/t/best-practice-about-index-pattern-definition/67156/3 "2016-12-23T07:16:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.