Group several different indexes

Elastic Stack Kibana
1

Hello ELK community.

I have been using ELK for a few days now and I have a question that I can not solve, I will try to explain to you so that you can better understand:

I schematize:

I have a switch, configured to send its syslog logs to 192.168.10.10.
On this 192.168.10.10 server, elastic and logstash are running quietly, the index (IND1) is created when I receive the data.

I have another switch, configured to send its syslog logs to 192.168.10.20
On this 192.168.10.20 server, elastic and logstash are also running quietly, the index (IND2) is created when I receive the data.

What I would like to do is visualize using Kibana on my 192.168.10.20 server the index of the first switch and the index of the second switch.

192.168.10.20 (Kibana) recovers IND1 of 192.168.10.10 and IND2 of 192.168.10.20

It's possible ?

2

What is the actual index pattern you are using?

3

In the pipeline of my server 192.168.10.10 is use the index name : "logstashfpe1"
In the pipeline of my server 192.168.10.20 is use the index name :"logstashfpe2"

And i would like to visualize these two index in only one Kibana.
I just made a small drawings to facilitate understanding :

ELKissue
ELKissue.png1043×498 10.3 KB

4

I think the solution would be to redirect the index created by 192.168.10.10 into ElasticSearch of 192.168.10.20 but I do not know how to proceed.

5

Or maybe I have to join the 192.168.10.10 node in the 192.168.10.20 cluster?

6

Ideally you want a single cluster and both Logstash instances send to that cluster.
Then you can put the different logs into one shared index, or different ones.

Make sure you use time based indices though.

7

Thx I just solve my problem, ! thx u

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.