# What is the best query in kibana to select logs just from one app?

**URL:** <https://discuss.elastic.co/t/what-is-the-best-query-in-kibana-to-select-logs-just-from-one-app/111136>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 11, 2017, 4:03pm UTC](https://discuss.elastic.co/t/what-is-the-best-query-in-kibana-to-select-logs-just-from-one-app/111136 "2017-12-11T16:03:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![przemolb](https://avatars.discourse-cdn.com/v4/letter/p/a9adbd/32.png) [@przemolb](https://discuss.elastic.co/u/przemolb)\
**Post date:** [December 11, 2017, 4:03pm UTC](https://discuss.elastic.co/t/what-is-the-best-query-in-kibana-to-select-logs-just-from-one-app/111136/1 "2017-12-11T16:03:30Z")

</div>

Hello,  
having the following filebeat and logstash configuration:

```auto
# filebeat
filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/*
  fields:
    type: system
  exclude_files: ['\.gz$', 'btmp*', 'wtmp*']
  close_inactive: 1h

- input_type: log
  paths:
    - /opt/app1/logs/*.log
  fields:
    type: app1
  exclude_files: ['\.gz$']
  close_inactive: 5h

output.logstash:
  hosts: ["x.x.x.x:5043"]

```

```auto
# logstash on x.x.x.x
input {
    beats {
        port => "5043"
    }
}
output {
    elasticsearch {
        hosts => ["y.y.y.y:9200"]
        manage_template => false
        index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
        document_type => "%{[@metadata][type]}"
    }
}

```

How do I create a query on kibana to select logs just from /opt/app1/logs/\*.log files ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2018, 4:03pm UTC](https://discuss.elastic.co/t/what-is-the-best-query-in-kibana-to-select-logs-just-from-one-app/111136/2 "2018-01-08T16:03:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.