# Index naming for large amount of log sources

**URL:** <https://discuss.elastic.co/t/index-naming-for-large-amount-of-log-sources/92335>\
**Category:** Elasticsearch\
**Created:** [July 7, 2017, 9:32pm UTC](https://discuss.elastic.co/t/index-naming-for-large-amount-of-log-sources/92335 "2017-07-07T21:32:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vb4t](https://avatars.discourse-cdn.com/v4/letter/v/a698b9/32.png) [@vb4t](https://discuss.elastic.co/u/vb4t)\
**Post date:** [July 7, 2017, 9:32pm UTC](https://discuss.elastic.co/t/index-naming-for-large-amount-of-log-sources/92335/1 "2017-07-07T21:32:00Z")

</div>

Hello. We are going to index application logs from a lot of Windows application clusters, servers and ... Currently we are using following index naming:

clustername-logtype-YEAR.MONTH, for example bigwebcluster-eventlog-2017.07, bigwebcluster-iis-2017.07, ...

For every _-logtype-_ we have elasticsearch index template. For some very loggy clusters, we also add clustername-logtype-\* templates with different shard numbers.

If we want to search for some logtype in different app cluster logs, we use _-logtype-_ pattern in kibana. For x-pack permissions we limit the access per clustertype so roleXZ has access to bigwebcluster-_, ... If we want to search across all types for some cluster we use clustername-_ pattern.

Is this a good idea to do naming like this? Or is it better to do naming like logtype-clustername-YEAR.MONTH? Which search is faster: _-logtype-_ or logtype-\*?

Thanks.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 7, 2017, 10:57pm UTC](https://discuss.elastic.co/t/index-naming-for-large-amount-of-log-sources/92335/2 "2017-07-07T22:57:21Z")

</div>

> [@vb4t](#):
>
> clustername-logtype-YEAR.MONTH

That seems like the best idea.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 4, 2017, 10:57pm UTC](https://discuss.elastic.co/t/index-naming-for-large-amount-of-log-sources/92335/3 "2017-08-04T22:57:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.