# How To classify and follow logs from different log files and machines

**URL:** <https://discuss.elastic.co/t/how-to-classify-and-follow-logs-from-different-log-files-and-machines/94836>\
**Category:** Elasticsearch\
**Created:** [July 27, 2017, 4:04pm UTC](https://discuss.elastic.co/t/how-to-classify-and-follow-logs-from-different-log-files-and-machines/94836 "2017-07-27T16:04:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Julien\_Hac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julien_hac/32/125923_2.png) [@Julien\_Hac](https://discuss.elastic.co/u/Julien_Hac)\
**Post date:** [July 27, 2017, 4:04pm UTC](https://discuss.elastic.co/t/how-to-classify-and-follow-logs-from-different-log-files-and-machines/94836/1 "2017-07-27T16:04:30Z")

</div>

Hi everyone,

I need to treat different source log file and see then in Kibana :

- Type log file - as batch log, server application log, apache server log
- Log from different machines

Here is my installation :

- First the machine send log to Redis by Filebeat,
- then Logstash indexer retreive the log and send to elasticsearch,
- then Kibana retreive the datas in elasticsearch

How can i distinguish log from apache or server app in kibana ?

How can i distinguish log from different machines ?

Of course the logs should not be merge otherwise i couldn't read the log sequentially... how to follow a type of log sequentially to track it easily ?

Thank you for help 🙂

---

<div class="post-metadata">

**Author:** ![josephjohney](https://avatars.discourse-cdn.com/v4/letter/j/eada6e/32.png) [@josephjohney](https://discuss.elastic.co/u/josephjohney)\
**Post date:** [July 27, 2017, 5:11pm UTC](https://discuss.elastic.co/t/how-to-classify-and-follow-logs-from-different-log-files-and-machines/94836/2 "2017-07-27T17:11:52Z")

</div>

You can distinguish each log or patterns in most of these applications

Try to use document\_type in filebeat,which is ver useful in logstash ( it will be 'type'in logstash ) and will be part of the metadata.  
Also use tags and fields in Filebeat.

From logstash try tocreate elasticsearch indices based on the type..

Also try to create indexes in uniform formats so that a pattern consolidating many indices could be defined in kibana

---

<div class="post-metadata">

**Author:** ![Julien\_Hac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/julien_hac/32/125923_2.png) [@Julien\_Hac](https://discuss.elastic.co/u/Julien_Hac)\
**Post date:** [July 28, 2017, 10:05am UTC](https://discuss.elastic.co/t/how-to-classify-and-follow-logs-from-different-log-files-and-machines/94836/3 "2017-07-28T10:05:52Z")

</div>

Thank for you answer,  
So im going to add document\_type for my different log file and create different elasticsearch index in some cases.

But, in order to distinguish the mulitple machines log (i have a cluster of different machines), can i use the beat.hostname ? If i use it i wouldn't need to add a redundant new field to know if the log is from host1 or host2 etc...  
so i could filter on beat.hostname in kibana to identify a same kind of log with different machine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2017, 10:06am UTC](https://discuss.elastic.co/t/how-to-classify-and-follow-logs-from-different-log-files-and-machines/94836/4 "2017-08-25T10:06:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.