Wasn't sure whether to post this question in Logstash forum or ElasticSearch since it can technically be in either.
Scenario: Multiple applications logging to a single ELK stack. Each application's logs will differ in format. All application logs will log to the same index (logstash-%date).
Question: How does one maintain index/mapping templates for each application stack in a sustainable and organized manner? Meaning if the log structure changes, it should be easy to change the mapping for that specific app without affecting other apps. It should also be versionable if possible.
I was thinking for this, best use would be to store the templates on logstash servers in a config directory where they are applied by logstash on the first message of a new index. The flat files could be versioned and easily modified/replaced.
Would love to hear how other people are handling this and what options and possibilities there are that I may be missing.