# Winlogbeat to same index as logstash **URL:** \ **Category:** Logstash\ **Created:** [August 7, 2017, 8:17pm UTC](https://discuss.elastic.co/t/winlogbeat-to-same-index-as-logstash/96150 "2017-08-07T20:17:54Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![lschoonaert](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@lschoonaert](https://discuss.elastic.co/u/lschoonaert)\ **Post date:** [August 7, 2017, 8:17pm UTC](https://discuss.elastic.co/t/winlogbeat-to-same-index-as-logstash/96150/1 "2017-08-07T20:17:54Z")
Hi there, I'm trying to get all my logs into 1 index - I have DNS logs currently going into logstash (lumberjack), now when I want to sen windows eventlogs, I'd like them to be index in the logstash-\* index. I this possible, as far as I see using winlogbeat you need to create a new index called winlogbeat-\*. The use case is being able to interrogate all data (network/machine) created by sysmon, eventlogs, dns logs, proxy logs). Having a separate index for the wineventlogs makes the correlation impossible. Any help would be greatly appreciated! Luk ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [August 7, 2017, 8:50pm UTC](https://discuss.elastic.co/t/winlogbeat-to-same-index-as-logstash/96150/2 "2017-08-07T20:50:54Z")
> [@lschoonaert](#): > > I’m trying to get all my logs into 1 index This is perhaps not in your best interest. Starting in version 6, Elasticsearch will only allow one document type per index. Separate indices are a better way to go for future compatibility. ---
**Author:** ![lschoonaert](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@lschoonaert](https://discuss.elastic.co/u/lschoonaert)\ **Post date:** [August 8, 2017, 7:29am UTC](https://discuss.elastic.co/t/winlogbeat-to-same-index-as-logstash/96150/3 "2017-08-08T07:29:27Z")
Hi AAron, thanks for the heads up - but what's the points of log centralization if you then can'ts search centralized? or will there be mutliple-index search support? And what exactly do you mean by "one document type"? Thanks, Luk ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 8, 2017, 7:35am UTC](https://discuss.elastic.co/t/winlogbeat-to-same-index-as-logstash/96150/4 "2017-08-08T07:35:07Z")
> [@lschoonaert](#): > > thanks for the heads up - but what’s the points of log centralization if you then can’ts search centralized? or will there be mutliple-index search support? Elasticsearch, and Kibana, can search across multiple indices out of the box. > [@lschoonaert](#): > > And what exactly do you mean by “one document type”? Have a look at [Index vs. Type | Elastic Blog](https://www.elastic.co/blog/index-vs-type) ---
**Author:** ![lschoonaert](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@lschoonaert](https://discuss.elastic.co/u/lschoonaert)\ **Post date:** [August 18, 2017, 8:52am UTC](https://discuss.elastic.co/t/winlogbeat-to-same-index-as-logstash/96150/5 "2017-08-18T08:52:01Z")
when I perform a search I need to select the index I perform the search on, so I don't see how I can query multiple indexes simultaneously. I.e. I have 2 indexes one for syslog and one for event logs - I search for IP 10.0.0.1 and I want results from both indexes - how do I do that then? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 18, 2017, 8:54am UTC](https://discuss.elastic.co/t/winlogbeat-to-same-index-as-logstash/96150/6 "2017-08-18T08:54:26Z")
How are you searching? ---
**Author:** ![lschoonaert](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@lschoonaert](https://discuss.elastic.co/u/lschoonaert)\ **Post date:** [August 18, 2017, 9:13am UTC](https://discuss.elastic.co/t/winlogbeat-to-same-index-as-logstash/96150/7 "2017-08-18T09:13:11Z")
Hi Mark, I go to Discover, select the index and then search in the field above it. Maybe I'm missing something really obvious? L. ![00](https://us1.discourse-cdn.com/elastic/original/3X/c/9/c95c4913f247d33e2c00e4c24a7f1e61adb8b6f9.png) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 18, 2017, 9:45am UTC](https://discuss.elastic.co/t/winlogbeat-to-same-index-as-logstash/96150/8 "2017-08-18T09:45:19Z")
You need to have a common prefix in front of the index, eg `commonword-` so each index becomes `commonword-winlogbeat-` etc, and then you can setup an index pattern called `commonword-*` that will read them all. That is a bit hard to backfill so it might be easier to setup an alias across things - [https://www.elastic.co/guide/en/elasticsearch/reference/5.5/indices-aliases.html#alias-adding](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/indices-aliases.html#alias-adding) ---
**Author:** ![lschoonaert](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@lschoonaert](https://discuss.elastic.co/u/lschoonaert)\ **Post date:** [August 18, 2017, 9:47am UTC](https://discuss.elastic.co/t/winlogbeat-to-same-index-as-logstash/96150/9 "2017-08-18T09:47:28Z")
Ahhh thank you! I'll try that! Many thanks for your help L. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 15, 2017, 9:47am UTC](https://discuss.elastic.co/t/winlogbeat-to-same-index-as-logstash/96150/10 "2017-09-15T09:47:45Z")
Closed on September 15, 2017, 9:47am UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.