Show different Index for different fields

[Mehak_Bhargava]

I have a field called fields.log_type which has three values- access, errors, dispatch. I want each value to be its own index on discover tab. Is it possible?

Time                                                    message                                               fields.log_type
Jan 7, 2020 @ 11:11:33.281            <incidentid>24749056</incidentid>   access
Jan 7, 2020 @ 11:11:33.139         Workflow.InIsDispatchPaused = true    dispatch

[cheiligers]

@Mehak_Bhargava Thank you for your question. I'm not sure I understand exactly what you mean by each value to be its own index. Do you want each value (access, errors and dispatch) to be individual index patterns or do you want these to be columns in the Discover table?
If neither of these matches what you want, could you maybe provide an annotated screen shot of your desired result?
Thanks!

[Mehak_Bhargava]

@cheiligers, thanks for responding! Sorry for the confusing statement but what I mean is that as shown below in screenshot, I want IncidentLogErrorIndex label to be created and then all values with field.log_type=errors shows up. And Hence make three such filters that separate out the results.
Right now I have to make it repeatedly since these are filters only. And when filter is for access logs, i have to delete the errors filter. So just it in a way where i click this custom label and required output is shown, similar to how fields function.

[cheiligers]

@Mehak_Bhargava, I think I understand now, thank you for the screen shot and the extra information. I'm not sure if you are aware of the extra options that filters give you. For example, you could create three filters, one for each of the different values of fields.log_type. To only have one of them active, you can temporarily disable the other two by clicking on the filter pills and selecting the Temporarily disable option. There are other options for filter pills too: https://www.elastic.co/guide/en/kibana/current/field-filter.html#filter-pinning.

[Mehak_Bhargava]

@cheiligers, just applied that and it works.
But is there a better way to separate the logs result based on fields.log_type? I have been trying to make multiple index and even have a discussion page going on it but haven't been successful at it so thought this way of using filters, if not replicate but help with the purpose of multiple index.

All files collected under on index only. Is it possible to have multiple indexes for multiple files?

EVery time I search GET cat/index? in kibana, I only get one index under all files are collected. I want to get three indexes for three different log files given in filebeat. This is logstash.conf file input { beats { port => 5044 } } filter { if[log_type] =="access"{ grok { match => {"message" => "%{COMBINEDAPACHELOG}"} } else if [log_type] == "errors" { grok { match => { "message" => "%{COMBINEDAPACHELOG}" } } }else [log_type] == "dispatcher"…

[cheiligers]

@Mehak_Bhargava I would also have suggested dividing the index pattern up using Logstash and hopefully that will work eventually!