Combine 2 or more beats in one panel / visualization

[alipujaistopo (Ali Nugraha Pujaistopo)]

i have 2 beats. filebeat and auditbeat, can i combine that 2 index in 1 panel visualization.

[matw (Matthias Wilhelm)]

Hi
Could you elaborate which kind of visualization you mean? Do you want to view the logs in one panel? you could create an index pattern targeting both beat indices, create a saved search in Discover, add it on a Dashboard.

Best,
Matthias

[alipujaistopo (Ali Nugraha Pujaistopo)]

the "data table" i mean. in one data table i can choose a source from auditbeat-* and filebeat-*

[matw (Matthias Wilhelm)]

you could create in index pattern *beat-* so you would combine both

[alipujaistopo (Ali Nugraha Pujaistopo)]

how to make it?

[matw (Matthias Wilhelm)]

You can create one in Stack Management / Index patterns -> Create index pattern

[matw (Matthias Wilhelm)]

if you want to match all beat indices you can add it like this:

[alipujaistopo (Ali Nugraha Pujaistopo)]

thanks Matthias