How to create separate index for separate devices?

Blason · March 17, 2018, 6:19pm

Hi there,

I have around 8-10 devices which are sending logs to logstash over syslog. I need to if I can have separate index created per dvice? like logstash-router1-, logstash-firewall-, logstash-nginx-* and so on?

What do I need to do to achieve the same? Rewrite separate templates or mappings? Pls advise.

Badger · March 17, 2018, 6:45pm

If you have a hostname or a device type in the syslog message then you could make the index name refer to that.

index => "logstash-%{hostname}-%{+YYYY.MM.dd}"

Blason · March 17, 2018, 6:50pm

Hey,

Thanks and how about mapping then? I guess that would be changed as well?

magnusbaeck · March 19, 2018, 6:34pm

The fields in your indexes will be mapped according to index templates and, as a fallback, Elasticsearch's automapper. Depending on your mapping requirements you may or may not need different templates.

Blason · March 20, 2018, 1:16pm

Well I am still lacking in templates and mappings and still looking for basic doc which could describe how and why to create templates?

magnusbaeck · March 20, 2018, 5:59pm

And you've read the sections about mappings and index templates in the Elasticsearch documentation?

Badger · March 20, 2018, 6:50pm

I would start with an index name that starts with logstash- (so it matches the default template) and not worry about templates until you find a problem that requires one.

system · April 17, 2018, 6:51pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.