I have Test and production logs going to the same elasticsearch cluster. how can i separate them ?
Which tool is sending data to elasticsearch?
Logstash would be sending data to elasticsearch
So you have a configuration for production and one for dev?
Just change the output plugin to send to the right cluster then.
If you have more questions about logstash, I'd recommend asking in #logstash group.