# Full text vs multi fields **URL:** \ **Category:** Elasticsearch\ **Created:** [October 23, 2017, 7:07pm UTC](https://discuss.elastic.co/t/full-text-vs-multi-fields/104956 "2017-10-23T19:07:12Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![mkorayem](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mkorayem/32/85774_2.png) [@mkorayem](https://discuss.elastic.co/u/mkorayem)\ **Post date:** [October 23, 2017, 7:07pm UTC](https://discuss.elastic.co/t/full-text-vs-multi-fields/104956/1 "2017-10-23T19:07:12Z")
Hi, Which is better, as an example for logs (it will be Linux, windows, network devices, UPS, cameras, etc ...) 1. Keep the message in one field and depend on full text search 2. or grok them into multiple known fields such as program, id, ssh user, failed login , etc ... Also, make each separate type in a different index like from /var/log/secure and others from /var/log/messages or network devices in another index or make index by day and put all syslog together? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 25, 2017, 4:10am UTC](https://discuss.elastic.co/t/full-text-vs-multi-fields/104956/2 "2017-10-25T04:10:23Z")
It's always going to be better to break the message down into fields. Put logs that share the same format in the same index, otherwise they should have their own. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 22, 2017, 4:10am UTC](https://discuss.elastic.co/t/full-text-vs-multi-fields/104956/3 "2017-11-22T04:10:49Z")
Closed on November 22, 2017, 4:10am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.