I have been testing out ELK for monitoring our Windows Event Viewer logs, IIS logs and network switch logs. I have been having some serious performance issues. Not to mention when running queries I frequently get something like "Courier Fetch: 40 of 1410 shards failed.". Which upon further troubleshooting I am finding that this is due to: "nested: ExpressionScriptCompilationException[Field [cs_bytes] used in expression does not exist in mappings]" which I need to find a fix for.
My question is that is it better to separate log types out into different indexes? Such as syslog entries in one index (such as [syslog-]YYY.MM.DD), IIS logs in another ([iis-]YYYY.MM.DD) and event logs in another ([events-]YYYY.MM.DD)? Is there an "easy" way to re-index the old data all in one [logstash-]YYYY.MM.DD index to separate indexes?
The machine that I am running this on is a quad core VM with 65G of ram.