# Differences between Discover and Logs?

**URL:** <https://discuss.elastic.co/t/differences-between-discover-and-logs/161184>\
**Category:** Logs\
**Created:** [December 17, 2018, 3:36pm UTC](https://discuss.elastic.co/t/differences-between-discover-and-logs/161184 "2018-12-17T15:36:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![phr0gz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phr0gz/32/9454_2.png) [@phr0gz](https://discuss.elastic.co/u/phr0gz)\
**Post date:** [December 17, 2018, 3:36pm UTC](https://discuss.elastic.co/t/differences-between-discover-and-logs/161184/1 "2018-12-17T15:36:38Z")

</div>

Hello,  
The live stream feature seems really nice! But I'm a little bit confused about this functionality: It looks like the same as the "Discover" view...isn't it?

We are already using the Elastic stack as a "big" farm to parse, store, and analyse the logs (10TB/month). Beat is not an option because it doesn't work on closed systems like appliances, network devices... so I really hope you will not focus only on beat 🙂

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [December 21, 2018, 9:46am UTC](https://discuss.elastic.co/t/differences-between-discover-and-logs/161184/2 "2018-12-21T09:46:40Z")

</div>

The data used for Discovery and the Log UI is the same. By default the Log UI looks for the indices of Filebeat but you can configure it to any index you want, so it should also work with your data. What does your index pattern look like?

---

<div class="post-metadata">

**Author:** ![phr0gz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phr0gz/32/9454_2.png) [@phr0gz](https://discuss.elastic.co/u/phr0gz)\
**Post date:** [January 7, 2019, 4:04pm UTC](https://discuss.elastic.co/t/differences-between-discover-and-logs/161184/3 "2019-01-07T16:04:39Z")

</div>

Thanks for the answer, we use multiple index patterns (around 20 patterns using 20 different templates in ES).  
We parse system/event logs from linux/windows/switch/router.  
And also antispam appliances, radius appliances...

In the doc you highlighted me in an [other post](https://discuss.elastic.co/t/multiple-fields-instead-of-message/161301/2) it does not seems to be possible to use multiple "log templates/patterns".

But I may not understand correctly and maybe it is possible to change the "default" value in "xpack.infra.sources. **default**.someparameter" to use multiple templates.  
e.g.

```auto
xpack.infra.sources.linuxevent.logAlias: 'logstash-event-linux-*'
xpack.infra.sources.linuxevent.fields.timestamp: 'mytimestampfield'
xpack.infra.sources.linuxevent.fields.message: 'field1', 'field2', 'field3', 'field4', 'field5'
xpack.infra.sources.windowsevent.logAlias: 'logstash-event-windows-*'
xpack.infra.sources.windowsevent.fields.timestamp: 'myothertimestampfield'
xpack.infra.sources.windowsevent.fields.message: 'field1', 'field2', 'field3'
xpack.infra.sources.switchevent.logAlias: 'logstash-event-switch-*'
xpack.infra.sources.switchevent.fields.timestamp: 'othertimestampfield'
xpack.infra.sources.switchevent.fields.message: 'field1', 'field2'

```

Is it possible or planned to be able to use multiple logalias/timestamp/message depending the index?

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [January 7, 2019, 4:05pm UTC](https://discuss.elastic.co/t/differences-between-discover-and-logs/161184/4 "2019-01-07T16:05:59Z")

</div>

It is definitely planned, but unfortunately not yet possible. Thanks for giving us some insights into your use-case.

---

<div class="post-metadata">

**Author:** ![phr0gz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phr0gz/32/9454_2.png) [@phr0gz](https://discuss.elastic.co/u/phr0gz)\
**Post date:** [January 7, 2019, 4:15pm UTC](https://discuss.elastic.co/t/differences-between-discover-and-logs/161184/5 "2019-01-07T16:15:11Z")

</div>

> [@weltenwort](#):
>
> nitely planned, but unfortunately not yet possible. Thanks for giving us some insights into your use-case.

Wow quick answer, I'm glad to hear that ! BTW the live view can be very useful when you need to troubleshot in live flows or problem with appliances.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 4, 2019, 4:15pm UTC](https://discuss.elastic.co/t/differences-between-discover-and-logs/161184/6 "2019-02-04T16:15:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.