I was just wondering if somebody could help clear up some confusion I am having when it comes to logstash. So in my current .conf file I have the output set to elasticsearch. This is where my questions start to pop up.
- Do you have to specify an index in the logstash conf file for it to be indexed into kibana correctly? In my experience I thought that this was necessary because I wasn't seeing data in kibana without it. This is how my current output section of my .conf file looks:
hosts => ["localhost:9200"]
index => "winlogbeat-7.13.2-2021.07.02-000001"
To view data using the winlogbeat dashboards is it necessary to specify the index.
- If it is necessary to specify that index how would you pipe multiple different types of beats through the same logstash? For example if I am business that monitors logs coming from different types of computers (Windows, Macos, and Linux) does this mean I have to setup multiple different instances of logstash? Does every different type of data with a different index need to be piped through its own logstash?
These questions come from a lack of understanding with how indexes work. Any clarification would be great.