# Best practice logstash/filebeat **URL:** \ **Category:** Logstash\ **Created:** [March 18, 2020, 10:49am UTC](https://discuss.elastic.co/t/best-practice-logstash-filebeat/224078 "2020-03-18T10:49:40Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![ledoc](https://avatars.discourse-cdn.com/v4/letter/l/e47774/32.png) [@ledoc](https://discuss.elastic.co/u/ledoc)\ **Post date:** [March 18, 2020, 10:49am UTC](https://discuss.elastic.co/t/best-practice-logstash-filebeat/224078/1 "2020-03-18T10:49:40Z")
Hello there, I have question on best practice of logstash, and workspace in kibana. On my ELK test environment, I have filebeat/nxlog/gelf \> logstash \> elasticsearch (standard configuration). - First, I have a lot of application's logs, and I want send them in each index distinct. Logstash configuration is a little hard, because if I have a syntax error, or anything else, all logstash crash, so all logs are not collected. I've think to put a variable in filebeat like index\_name, and split all my fields in filebeat, and send them to logstash. Also, logstash would be very simple, input, and output to es with index = index\_name variable. What do you think about it ? - Second, I would like to split each applications (log view, and dashboard view, maybe more) in workspaces. With this, I can create role for production staff to access all workspaces with production applications, and dev role for all workspace dev In roles, I have to manage workspace, and index rules. What do you think about it ? Thanks for your opinion. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 15, 2020, 10:49am UTC](https://discuss.elastic.co/t/best-practice-logstash-filebeat/224078/2 "2020-04-15T10:49:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.