How to separate devices/logfiles

Elastic Stack Logstash
1

Hello,

I just want to know how a logical separation should/could look like for different types of devices.

Let's say I have a bunch of switches and a bunch of servers which can send syslog messages.
How should I separate them in Elasticsearch (two groups: switches and servers)? How could this look like in the logstash configuration? Are there any guidelines?

Is there any function I can group devices? Maybe lets say all devices in a specific range will get index "X" and other ones get index "Y"?

Regards
ELK212

2

You could do that with a conditional block and then add a tag to the event with mutate. That'd be the easiest way I can think of.

3

Are you using filebeat to send logs to Logstash?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.