Fetch data from multiple indices in near realtime

[Bryce_Fernandes]

Hi,

I have multiple indices for an application.
eg. infra logs in infra-*, apache logs in filebeat-*, uptime in heartbeat-* , applicaion in apm-* etc.

So want to create a dashboard that will have boxes for each application. Box will show health of applications based on few parameters from above indices.
So box can either contain down up or color coded.

eg. if cpu > 70 or mem > 70 or status code = 404 or monitor1 = down or transaction duration > 10
then box will show down.

How can I achieve this.
One way I can think of is fetch the fields data from the indices using elasticsearch filter plugin and based on condition output it to a field in a single index.

Is there a better less resource intensive way to achieve this.

Regards,
Bryce Fernandes.

[Badger]

This is not a logstash question, you should move it to the kibana forum.