Seperate filebeats for different groups of servers

you can have logstash in between. You can have more control on your data if you have logstash in between.

Of course, you can change index names coming from filebeat especially if you have logstash.

  • Just tag the dataset in filebeat (inputs.d) or fields (eg. .. my_db_oracle)
  • in Logstash, just do the logic based on tag or fields and redirect to relevant index (eg: index on condition)