You could create a separate index, or you could put it into the same index and have put the error level into it's own field.
If you want separate mappings you would probably be better off doing separate indexes.
Logstash has a way of dynamically creating separate indexes.
For example, let's say you put the logging level into a field called "LogLevel". In your Logstash output you could put something like the below. This will create a dynamic index with the loglevel included in the index name. For example, today's index would be "Logfiles-INFO-2016.04.11", "Logfiles-ERROR-2016.04.11", and so on.
You would probably want to do some verification that LogLevel doesn't ever get weird values in it, otherwise you might end up with some strange index names.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.