# Create Different "Index Management" and "Index Pattern" For Different Firewall Devices

**URL:** https://discuss.elastic.co/t/create-different-index-management-and-index-pattern-for-different-firewall-devices/294678
**Category:** Kibana
**Created:** [January 18, 2022, 9:41am UTC](https://discuss.elastic.co/t/create-different-index-management-and-index-pattern-for-different-firewall-devices/294678 "2022-01-18T09:41:26Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Xenial](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xenial/32/97821_2.png) [@Xenial](https://discuss.elastic.co/u/Xenial)
#### Post date: [January 18, 2022, 9:41am UTC](https://discuss.elastic.co/t/create-different-index-management-and-index-pattern-for-different-firewall-devices/294678/1 "2022-01-18T09:41:26Z")

</div>

Hello Team,

I want to create Dashboarding system (SIEM) For two different firewall device (Panorama Palo Alto, Fortianalyzer Fortinet). I want to use Filebeat Modules PANW and FORTINET. How i create 2 Index Management and 2 Index Pattern to separate 2 Log  
PANW From port 5514(UDP)  
Fortinet From port 5515(UDP).

I've create dashboarding using filebeat PANW and 1 Index management and index pattern.

 ![Index Management1](https://us1.discourse-cdn.com/elastic/original/3X/9/2/9269008ffea324cf8bf166deda2d39df3027d197.png)  
Index Management For PANW

![Index Pattern1](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7cf78ea5b1d9cb4a5852ea4ffdbbfdb745818c94.png)  
Index Pattern For PANW

![Fortinet yml](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f3a1d1e234da8a870e3dc3c1ffab58b0c201f797.png)  
Fortinet.yml

Anyone can help me for configure this thing?

Thankyou

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [January 19, 2022, 5:31pm UTC](https://discuss.elastic.co/t/create-different-index-management-and-index-pattern-for-different-firewall-devices/294678/2 "2022-01-19T17:31:10Z")

</div>

You should not need to create separate indexes and index patterns there is no need to, in fact it will make it more difficult both data sets / FWs going into `filebeat*` indices will be fine and is how elastic is designed.

Each Document will have an `event.dataset` fields that will distinguish them.

Just configure the new module...  
Then IMPORTANT run setup again....  
`filebeat setup -e`

Then start filebeat for the new FW and it should work.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 16, 2022, 5:32pm UTC](https://discuss.elastic.co/t/create-different-index-management-and-index-pattern-for-different-firewall-devices/294678/3 "2022-02-16T17:32:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.