Combine 2 or more beats in one panel / visualization

i have 2 beats. filebeat and auditbeat, can i combine that 2 index in 1 panel visualization.

Could you elaborate which kind of visualization you mean? Do you want to view the logs in one panel? you could create an index pattern targeting both beat indices, create a saved search in Discover, add it on a Dashboard.


the "data table" i mean. in one data table i can choose a source from auditbeat-* and filebeat-*

you could create in index pattern *beat-* so you would combine both

how to make it?

You can create one in Stack Management / Index patterns -> Create index pattern

if you want to match all beat indices you can add it like this:

thanks Matthias

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.