Use of filebeat templates - single template vs multiple templates

Elastic Stack Logstash
1

I'm confused about the use of filebeat templates with the file fields.yml.

If I want to store two types of logs into elasticsearch, let's say apache logs and postgres logs, is it better to have a single template in the file fields.yml, or should I instead use multiple templates (logstash-6.2.3-apache* and logstash-6.2.3-postgres*)?

  • If I chose the former, is it really a good practice to merge the definition of unrelated fields into a single template?
  • If I chose the latter, am I supposed to setup my templates manually in elasticsearch with PUT _template/logstash-6.2.3-apache for example?
2

I want to define my own templates, because I want to store logs other than apache and postgres which don't have modules available

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.