Should we create New Index or Use the same index for all application logs(number of app ~ 5)

Elastic Stack Elasticsearch
1

I have about 5 apps to monitor using log parsing with ELK.
Does it make sense to create new index for each application log or only one index is sufficient to store all app logs. The logs for these apps would also contain ERROR and WARNING fields which would help visualize error and warnings separately in a great way.
Thanks

2

Welcome to our community! :smiley:

Are they all the some format, or very different?

3

some are access logs, some are airflow logs and hadoop logs etc

4

It's a good idea to group logs that share the same structure, and you can use ECS to reformat them if you'd like,

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.