Master and slave using same index

Elastic Stack Elasticsearch
1

I will use filebeat -> logstash -> Elasticsearch cluster

I have 2 server filebeat installed. Can i use same index name for the 2 server?

2

Can you explain what you want to do?

Elasticsearch does not have master/slave configuration, all data nodes are part of the cluster.

1 Like
3

I hve 2 server (master and slave) which i installed filebeat in it. Can i use same index name in lgostash for log receive from master and slave via filebeat?

Besides, is there a way to append current date and year in filebeat.input. my log name is myapp.log.YYYYMMDD

4

Oh I see, master and slave are your servers from where the logs will be collected by filebeat.

In this case you can use the same index name and all the data will be in the same index.

If your log name is something like myapp.log.YYYMMDD, you will need to use myapp.log.*, or explicitly specify the date like myapp.log.20210820, it is not possible to specify the date dynamically.

5

If we specify myapp.log.*, i believe it will result in taking old data right sir. i mean back value dataed. but i believe it will only take once since filbeat registry will keep track

6

You can tell filebeat to ignore files older than a specific number of time.

Take a look at this part of the documentation.

7

Thanks sir. Sorry this my last question.

Earlier i am planning to use index name based on file name. But as i search online it is a bad practice having multiple small index.

Can i use index based on team name. Each team have few log under them which some are same format some are not same format. Is this approach ok? this result in 10 index per environment server

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.