I'm sending my application's logs to logstash as json and I want to save them in elasticsearch by different indices.
In fact, I want to save logs of each user in a unique index that is equal to user key in the incoming json document. Because I want to provide different services to different users.
- document storage time and also services for users can vary.
- log content of each user may increase and I intend to increase the query speed by separating the indices.
Q1: Is it a good idea to separate each user's index?
Q2: How can I do it in logstash output config file?