I'm confused about the use of filebeat templates with the file
If I want to store two types of logs into elasticsearch, let's say apache logs and postgres logs, is it better to have a single template in the file
fields.yml, or should I instead use multiple templates (logstash-6.2.3-apache* and logstash-6.2.3-postgres*)?
- If I chose the former, is it really a good practice to merge the definition of unrelated fields into a single template?
- If I chose the latter, am I supposed to setup my templates manually in elasticsearch with
PUT _template/logstash-6.2.3-apachefor example?