I have syslogs from multiple types of network devices from multiple customers being processed by logstash. Our end goal is to sell different tiers of data retention. I'm thinking that if we can put a field in the syslog data, we can direct it to different indices in elasticsearch with logstash's elasticsearch output index option. But would it be more effective to use the ilm_pattern option and let ILM handle index creation? And, since there's no overlap between the devices, would it be more effective to split each type of device data into its own set of indices (e.g. logstash-firewall-, logstash-switch-)?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.