# Can someone please suggest better way here? **URL:** \ **Category:** Elasticsearch\ **Created:** [February 16, 2018, 3:10am UTC](https://discuss.elastic.co/t/can-someone-please-suggest-better-way-here/120093 "2018-02-16T03:10:25Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [February 16, 2018, 3:10am UTC](https://discuss.elastic.co/t/can-someone-please-suggest-better-way-here/120093/1 "2018-02-16T03:10:25Z")
Hi Guys, I have two locations and soon multiples will be added. Since elastic stack by default does not have multitenanacy I am planning to install multiple logstash instances at every location which eventually will gather the data in same elastic instance. Assuming I have LOC-A and LOC-B with logstash-loc-A and logstash-loc-B installed respectively how do I create different indexes for those locations and then create the different dashboards accordingly? I need to keep those completely separate. May be tagging will help? Please advise ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 16, 2018, 3:36am UTC](https://discuss.elastic.co/t/can-someone-please-suggest-better-way-here/120093/2 "2018-02-16T03:36:08Z")
> [@Blason](#): > > Since elastic stack by default does not have multitenanacy What do you mean by that? > [@Blason](#): > > how do I create different indexes for those locations and then create the different dashboards accordingly? Just create an index pattern of `logstash-loca-YYYY` and `logstash-locb-YYYY` (or whatever). Or. If the systems are the same in each location, then just send to the default index pattern and use tags. > [@Blason](#): > > Hi Guys, Not everyone on here is a guy 🙂 ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [February 16, 2018, 4:09am UTC](https://discuss.elastic.co/t/can-someone-please-suggest-better-way-here/120093/3 "2018-02-16T04:09:46Z")
OK - Multitenancy means I will be accepting logs from different logstash instances and wanted to know if multiple elasticinstances can be created or not like I have different Business partners, customers and let say I am planning for multiple logstash instances for those but will have same elastic at my end and dont wanna go for muliple elastic instances for those mulitple logstash server. We can monitor that elasticinstance centrally but need to create the complete different dashboards for those partners & customers. Like Customer-VA, Partner-WA, Customer-NY, Partner-LON this way ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 16, 2018, 4:19am UTC](https://discuss.elastic.co/t/can-someone-please-suggest-better-way-here/120093/4 "2018-02-16T04:19:03Z")
Then you want different indices in a single cluster. That's multitenancy and native to Elasticsearch. ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [February 16, 2018, 4:24am UTC](https://discuss.elastic.co/t/can-someone-please-suggest-better-way-here/120093/5 "2018-02-16T04:24:08Z")
Absolutely and thanks for that..In that case I am not so vered with Logstash parsers would you please guide me on templates? I mean since I will be creating different indices I definitely would need different templates as well? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 16, 2018, 4:33am UTC](https://discuss.elastic.co/t/can-someone-please-suggest-better-way-here/120093/6 "2018-02-16T04:33:17Z")
Yep that's the best idea 🙂 I find the easiest way is just to use an index pattern like `logstash-SOMETHING-YYYY`, define your own `SOMETHING` value, and then let the default template apply. After a while, you can then take the mappings and then optimise them. ---
**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\ **Post date:** [February 16, 2018, 6:45am UTC](https://discuss.elastic.co/t/can-someone-please-suggest-better-way-here/120093/7 "2018-02-16T06:45:55Z")
Where do I get the mappings and handy document on templates and optimizing those? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 18, 2018, 9:22pm UTC](https://discuss.elastic.co/t/can-someone-please-suggest-better-way-here/120093/8 "2018-02-18T21:22:34Z")
Check the `_template` API and [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html) Optimising depends on what you end up with. I'd let things run for a few days and then create a new template based on what is being created. Do things like removal of text fields in favour of keyword, making sure numbers are mapped correctly etc. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 18, 2018, 9:22pm UTC](https://discuss.elastic.co/t/can-someone-please-suggest-better-way-here/120093/9 "2018-03-18T21:22:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.