# Resources for modeling application log data?

**URL:** <https://discuss.elastic.co/t/resources-for-modeling-application-log-data/285849>\
**Category:** Logs\
**Created:** [October 4, 2021, 8:24pm UTC](https://discuss.elastic.co/t/resources-for-modeling-application-log-data/285849 "2021-10-04T20:24:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![swainstead](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@swainstead](https://discuss.elastic.co/u/swainstead)\
**Post date:** [October 4, 2021, 8:24pm UTC](https://discuss.elastic.co/t/resources-for-modeling-application-log-data/285849/1 "2021-10-04T20:24:21Z")

</div>

I've been working with our application logging and creating Kibana dashboards for a little while now.

I wonder though if I'm missing some best practices or techniques for designing the log messages themselves to get the most out of ELK. My inclination is to keep a single log message specific to a given topic or metric; but I wonder if more complex log statements might be better in some situations?

Are there any resources out there for this level of design thinking? Otherwise it's just trial and error, and I don't know if I've really gotten the most out of ELK. Searching Google for "best practices for application logging and Kibana" brings up results that are too high level (e.g. how to design to avoid shards, etc.)

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [October 25, 2021, 7:55pm UTC](https://discuss.elastic.co/t/resources-for-modeling-application-log-data/285849/2 "2021-10-25T19:55:53Z")

</div>

Have you looked at our beats dashboards - built in - to see if they will give you some inputs?

[Metricbeat: Lightweight Shipper for Metrics | Elastic](https://www.elastic.co/beats/metricbeat).  
I am transferring your topic to our logs forum to see if people there can help.

Thanks,  
Bhavya

Thanks,  
Bhavya

---

<div class="post-metadata">

**Author:** ![swainstead](https://avatars.discourse-cdn.com/v4/letter/s/c77e96/32.png) [@swainstead](https://discuss.elastic.co/u/swainstead)\
**Post date:** [October 26, 2021, 11:52am UTC](https://discuss.elastic.co/t/resources-for-modeling-application-log-data/285849/3 "2021-10-26T11:52:50Z")

</div>

I have not, however, someone pointed me to Elastic Common Schema and I'm going to plunge into that.

---

<div class="post-metadata">

**Author:** ![Kerry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kerry/32/40330_2.png) [@Kerry](https://discuss.elastic.co/u/Kerry)\
**Post date:** [October 27, 2021, 12:58pm UTC](https://discuss.elastic.co/t/resources-for-modeling-application-log-data/285849/4 "2021-10-27T12:58:21Z")

</div>

> I have not, however, someone pointed me to Elastic Common Schema and I'm going to plunge into that.

For compatibility with the Logs UI ECS is the way to go for sure.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 24, 2021, 12:58pm UTC](https://discuss.elastic.co/t/resources-for-modeling-application-log-data/285849/5 "2021-11-24T12:58:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.