Have a new ELK installation based on online tutorials which is currently scraping a log sent from a SINGLE generic syslog server. I am new so still very green on how many of the pieces fit together. RTFM is not working for me.
In Kibana you create an index based off of a discovered indice that is being sent to it from Logstash in my case. This indice has a name of filebeat as the syntax based on my installation. Everything works with a single server but need some clarification when I expand to multiple servers.
Where is the actual naming syntax specified in an ELK stack? At the Filebeat or Logstash level? Can I get pointed to the actual line in whatever .conf file this is usually specified?
Say I have two servers and leave both of them configured to send to the same indice name. On the same day does Elasticsearch for Logstash then merge the two "streams" or will I see two separate indices with the same name in Kibana?
How does everyone else handle multiple servers? Different indice for every server, group them by application (syslog, apache, etc...) or just let them exist in one single indice and rely on elasticsearch to sort through it after the fact.
Hope the questions make sense and thanks for everyone's time.