# Questions about Logstash + Elasticsearch + Kibana **URL:** \ **Category:** Elasticsearch\ **Created:** [March 22, 2015, 3:15am UTC](https://discuss.elastic.co/t/questions-about-logstash-elasticsearch-kibana/22798 "2015-03-22T03:15:17Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Gabriel\_Francisco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel_francisco/32/817_2.png) [@Gabriel\_Francisco](https://discuss.elastic.co/u/Gabriel_Francisco)\ **Post date:** [March 22, 2015, 3:15am UTC](https://discuss.elastic.co/t/questions-about-logstash-elasticsearch-kibana/22798/1 "2015-03-22T03:15:17Z")
Hi, I have some plans about using Logstash + Elasticsearch + Kibana at my company, and I have some questions. First of all, if I want to use a central elasticsearch cluster for several application logs, is there a way to define a schema per application? I mean, if one app uses an index typed as String and another app uses the same index as a number, that could be a problem, is that right? Is there a way to handle it? Second, we are planning to use one logstash and several logstash forwarders, but, if the applications had different filters, is it a problem to have a central logstash to handle all the logs and send to elasticsearch? Should we use one logstash per application? Waiting for an answer, thanks in advance! -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/24343b9e-b40b-4816-9f8a-9c76999233f9%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/24343b9e-b40b-4816-9f8a-9c76999233f9%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [March 22, 2015, 10:39pm UTC](https://discuss.elastic.co/t/questions-about-logstash-elasticsearch-kibana/22798/2 "2015-03-22T22:39:39Z")
If you are using LS to parse things then you probably want to define your values - ie string, int - in a grok, then output them into different indices. This will keep them separate. You can then also add a mapping to further enhance things. In your case it makes sense to just have a forwarder send to a central LS instance where the processing is done. On 22 March 2015 at 14:15, Gabriel Francisco [gabfssilva@gmail.com](mailto:gabfssilva@gmail.com) wrote: > Hi, I have some plans about using Logstash + Elasticsearch + Kibana at my > company, and I have some questions. > > First of all, if I want to use a central elasticsearch cluster for several > application logs, is there a way to define a schema per application? I > mean, if one app uses an index typed as String and another app uses the > same index as a number, that could be a problem, is that right? Is there a > way to handle it? > > Second, we are planning to use one logstash and several logstash > forwarders, but, if the applications had different filters, is it a problem > to have a central logstash to handle all the logs and send to > elasticsearch? Should we use one logstash per application? > > Waiting for an answer, thanks in advance! > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/24343b9e-b40b-4816-9f8a-9c76999233f9%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/24343b9e-b40b-4816-9f8a-9c76999233f9%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/24343b9e-b40b-4816-9f8a-9c76999233f9%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/24343b9e-b40b-4816-9f8a-9c76999233f9%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X\_38S4CPv79Zbe8qJZWA15JSCoAw7Z1NjCTwxRwO\_Tmdg%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X_38S4CPv79Zbe8qJZWA15JSCoAw7Z1NjCTwxRwO_Tmdg%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Gabriel\_Francisco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel_francisco/32/817_2.png) [@Gabriel\_Francisco](https://discuss.elastic.co/u/Gabriel_Francisco)\ **Post date:** [March 23, 2015, 2:16pm UTC](https://discuss.elastic.co/t/questions-about-logstash-elasticsearch-kibana/22798/3 "2015-03-23T14:16:09Z")
Actually, my whole log file is json format, and, I don't use any grok, I just log it into the file and logstash gets the json and sends to elasticsearch, indexing everything. In this case, what do you think I could do? Em domingo, 22 de março de 2015 19:40:07 UTC-3, Mark Walkom escreveu: > If you are using LS to parse things then you probably want to define your > values - ie string, int - in a grok, then output them into different > indices. This will keep them separate. You can then also add a mapping to > further enhance things. > > In your case it makes sense to just have a forwarder send to a central LS > instance where the processing is done. > > On 22 March 2015 at 14:15, Gabriel Francisco \<[gabfs...@gmail.com](mailto:gabfs...@gmail.com) > \\> wrote: > > > Hi, I have some plans about using Logstash + Elasticsearch + Kibana at my > > company, and I have some questions. > > > > First of all, if I want to use a central elasticsearch cluster for > > several application logs, is there a way to define a schema per > > application? I mean, if one app uses an index typed as String and another > > app uses the same index as a number, that could be a problem, is that > > right? Is there a way to handle it? > > > > Second, we are planning to use one logstash and several logstash > > forwarders, but, if the applications had different filters, is it a problem > > to have a central logstash to handle all the logs and send to > > elasticsearch? Should we use one logstash per application? > > > > Waiting for an answer, thanks in advance! > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \. > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/24343b9e-b40b-4816-9f8a-9c76999233f9%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/24343b9e-b40b-4816-9f8a-9c76999233f9%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/24343b9e-b40b-4816-9f8a-9c76999233f9%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/24343b9e-b40b-4816-9f8a-9c76999233f9%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/48016337-7dfc-404a-b746-4bd5d343269e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/48016337-7dfc-404a-b746-4bd5d343269e%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:24am UTC](https://discuss.elastic.co/t/questions-about-logstash-elasticsearch-kibana/22798/4 "2017-07-06T00:24:49Z")