Mapping different logs into a single index or keep separate?

Elastic Stack Kibana
1

Hello,
we are considering mapping all the ELB, ALB, CloudFront and API Gateway logs into a single json structure and pushing this for analysis in an ES cluster.
is this the right way to go about or should we push each log into a separate index and then pull data out of these from within kibana?
any advise is much appreciated

2

Have a look at ECS, it was built specifically for this type of approach.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.