How to create the Multiple Index for each Apache Webserver

Elastic Stack Beats
1

Hi,
I'm a new to ELK stack. Can anyone advice me for my below doubt.

For example, I have a two apache webserver and I installed filebeat on that and I enabled apache module. Also I configured apache.conf file in logstash. So for now my both apache server logs sent it to one common index that I specified in apache.conf file.

My requirement is how to create the one or more index and pass the apache server logs to particular index instead of common one.
apache server1 --> apache.conf (logstash/conf.d)
apache server1 --> apache1.conf (logstash/conf.d)

Can anyone please advise this.
Thanks

2

Hey @sanjeev1895 and welcome to the community!

You could use the server name from the event as it passes through Logstash as a variable in the Elasticsearch output similar to how it's shown in the docs. This would send each document as it came in from Filebeat to an index with that server name in it.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.