# Group several different indexes

**URL:** https://discuss.elastic.co/t/group-several-different-indexes/118581
**Category:** Kibana
**Created:** [February 6, 2018, 8:51am UTC](https://discuss.elastic.co/t/group-several-different-indexes/118581 "2018-02-06T08:51:30Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [February 6, 2018, 8:51am UTC](https://discuss.elastic.co/t/group-several-different-indexes/118581/1 "2018-02-06T08:51:30Z")

</div>

Hello ELK community.

I have been using ELK for a few days now and I have a question that I can not solve, I will try to explain to you so that you can better understand:

I schematize:

I have a switch, configured to send its syslog logs to 192.168.10.10.  
On this 192.168.10.10 server, elastic and logstash are running quietly, the index (IND1) is created when I receive the data.

I have another switch, configured to send its syslog logs to 192.168.10.20  
On this 192.168.10.20 server, elastic and logstash are also running quietly, the index (IND2) is created when I receive the data.

What I would like to do is visualize using Kibana on my 192.168.10.20 server the index of the first switch and the index of the second switch.

192.168.10.20 (Kibana) recovers IND1 of 192.168.10.10 and IND2 of 192.168.10.20

It's possible ?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 6, 2018, 8:54am UTC](https://discuss.elastic.co/t/group-several-different-indexes/118581/2 "2018-02-06T08:54:54Z")

</div>

What is the actual index pattern you are using?

---

<div class="post-metadata">

### Author: ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [February 6, 2018, 9:08am UTC](https://discuss.elastic.co/t/group-several-different-indexes/118581/3 "2018-02-06T09:08:38Z")

</div>

In the pipeline of my server 192.168.10.10 is use the index name : "logstashfpe1"  
In the pipeline of my server 192.168.10.20 is use the index name :"logstashfpe2"

And i would like to visualize these two index in only one Kibana.  
I just made a small drawings to facilitate understanding :

 ![ELKissue](https://us1.discourse-cdn.com/elastic/original/3X/0/3/0331c64ad55b968971b6b4ad0dd0e2875d3addfb.png)

---

<div class="post-metadata">

### Author: ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [February 6, 2018, 9:11am UTC](https://discuss.elastic.co/t/group-several-different-indexes/118581/4 "2018-02-06T09:11:35Z")

</div>

I think the solution would be to redirect the index created by 192.168.10.10 into ElasticSearch of 192.168.10.20 but I do not know how to proceed.

---

<div class="post-metadata">

### Author: ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [February 6, 2018, 9:23am UTC](https://discuss.elastic.co/t/group-several-different-indexes/118581/5 "2018-02-06T09:23:58Z")

</div>

Or maybe I have to join the 192.168.10.10 node in the 192.168.10.20 cluster?

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [February 6, 2018, 9:48am UTC](https://discuss.elastic.co/t/group-several-different-indexes/118581/6 "2018-02-06T09:48:44Z")

</div>

Ideally you want a single cluster and both Logstash instances send to that cluster.  
Then you can put the different logs into one shared index, or different ones.

Make sure you use time based indices though.

---

<div class="post-metadata">

### Author: ![dyl](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@dyl](https://discuss.elastic.co/u/dyl)
#### Post date: [February 8, 2018, 8:14am UTC](https://discuss.elastic.co/t/group-several-different-indexes/118581/7 "2018-02-08T08:14:01Z")

</div>

Thx I just solve my problem, ! thx u

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 8, 2018, 8:14am UTC](https://discuss.elastic.co/t/group-several-different-indexes/118581/8 "2018-03-08T08:14:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
