I would like to log from filebeat to one a custom index.
I would like to set filebeat to log filebeat-division1-* to logstash from one server and filebeat-division2-* from another server.
Then set access to those indexes for specific users.
Alternatively can you allow one user to only see logs with field division1 and another user only see division2 logs?
Assuming you send all this data through LS, you should be able to add some logic for example based on beat.hostname to which index the data goes. As soon as you have such an index pattern above, you can use X-Pack Security to define access rights based on index patterns.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.