# Ho to create single index for logs coming through fluentd, filebeat and logstash together? **URL:** \ **Category:** Elasticsearch\ **Created:** [January 9, 2019, 11:16pm UTC](https://discuss.elastic.co/t/ho-to-create-single-index-for-logs-coming-through-fluentd-filebeat-and-logstash-together/163631 "2019-01-09T23:16:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![vijayakrishna.rg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vijayakrishna.rg/32/36798_2.png) [@vijayakrishna.rg](https://discuss.elastic.co/u/vijayakrishna.rg)\ **Post date:** [January 9, 2019, 11:16pm UTC](https://discuss.elastic.co/t/ho-to-create-single-index-for-logs-coming-through-fluentd-filebeat-and-logstash-together/163631/1 "2019-01-09T23:16:27Z")
Hi, I have logs coming from kubernetes, nginx and jenkins machines. i have configured fluentd on kubernetes to get logs and filebeat on nginx to get access logs and logstash on jenkins machine, i want all these logs together in single index called "nprod-logs". all the kubernetes logs coming to elastic through index "nprod-logs", when i enabled filebeat on Nginx with same index name it's complaining and getting below error in elastic cluster log file. java.lang.IllegalArgumentException: Rejecting mapping update to [nprod-log-2019.01.09] as the final mapping would have more than 1 type: [doc, fluentd]. is there a way i can create single index for all the logs, because all of them are co-related for my load testing, please suggest me, Thanks. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 9, 2019, 11:27pm UTC](https://discuss.elastic.co/t/ho-to-create-single-index-for-logs-coming-through-fluentd-filebeat-and-logstash-together/163631/2 "2019-01-09T23:27:46Z")
You would be better off using an index pattern like `nprod-logs-SOURCE-YYYY.MM.DD`. Where `SOURCE` is nginx or jenkins or whatever app, and then `YYYY.MM.DD` is the date. Putting everything into one big index is not a good idea as you end up with mapping conflicts, multiple types (which are being rejected as you see) and it makes data management a hell of a lot harder. ---
**Author:** ![vijayakrishna.rg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vijayakrishna.rg/32/36798_2.png) [@vijayakrishna.rg](https://discuss.elastic.co/u/vijayakrishna.rg)\ **Post date:** [January 9, 2019, 11:32pm UTC](https://discuss.elastic.co/t/ho-to-create-single-index-for-logs-coming-through-fluentd-filebeat-and-logstash-together/163631/3 "2019-01-09T23:32:48Z")
It means creating multiple indexes. But as per my requirement, when i hit one service running on kubernetes it will pass through Nginx proxy through ingress controller through Kubernets service, it means it's single call logs into multiple services and i want see all these logs into single index. if i create multiple index then i need to search same query in kibana 3 times by changing index name in discovery tab, is there a way i can create single index logs coming through fluentd and filebeat? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 9, 2019, 11:40pm UTC](https://discuss.elastic.co/t/ho-to-create-single-index-for-logs-coming-through-fluentd-filebeat-and-logstash-together/163631/4 "2019-01-09T23:40:35Z")
> [@vijayakrishna.rg](#): > > if i create multiple index then i need to search same query in kibana 3 times by changing index name in discovery tab You can setup an index pattern of `nprod-logs-*` in Kibana which will search them all. I forgot to mention that in my other post sorry. ---
**Author:** ![vijayakrishna.rg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vijayakrishna.rg/32/36798_2.png) [@vijayakrishna.rg](https://discuss.elastic.co/u/vijayakrishna.rg)\ **Post date:** [January 9, 2019, 11:42pm UTC](https://discuss.elastic.co/t/ho-to-create-single-index-for-logs-coming-through-fluentd-filebeat-and-logstash-together/163631/5 "2019-01-09T23:42:53Z")
Thanks for suggestion, i thought same thing after replied to you. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 6, 2019, 11:42pm UTC](https://discuss.elastic.co/t/ho-to-create-single-index-for-logs-coming-through-fluentd-filebeat-and-logstash-together/163631/6 "2019-02-06T23:42:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.