Thanks for the answer, we use multiple index patterns (around 20 patterns using 20 different templates in ES).
We parse system/event logs from linux/windows/switch/router.
And also antispam appliances, radius appliances...
In the doc you highlighted me in an other post it does not seems to be possible to use multiple "log templates/patterns".
But I may not understand correctly and maybe it is possible to change the "default" value in "xpack.infra.sources.default.someparameter" to use multiple templates.
e.g.
xpack.infra.sources.linuxevent.logAlias: 'logstash-event-linux-*'
xpack.infra.sources.linuxevent.fields.timestamp: 'mytimestampfield'
xpack.infra.sources.linuxevent.fields.message: 'field1', 'field2', 'field3', 'field4', 'field5'
xpack.infra.sources.windowsevent.logAlias: 'logstash-event-windows-*'
xpack.infra.sources.windowsevent.fields.timestamp: 'myothertimestampfield'
xpack.infra.sources.windowsevent.fields.message: 'field1', 'field2', 'field3'
xpack.infra.sources.switchevent.logAlias: 'logstash-event-switch-*'
xpack.infra.sources.switchevent.fields.timestamp: 'othertimestampfield'
xpack.infra.sources.switchevent.fields.message: 'field1', 'field2'
Is it possible or planned to be able to use multiple logalias/timestamp/message depending the index?