How to show mulitple servers logs in kibana separatly from each other

user_13563267 0
Viewed 174

I have installed ELK on my Ubuntu server and install filebeat on remote server-A and server-B. I have configured Log-stash to receive data from filebeat and forward them to Elasticsearch. Both servers logs are showing in Kibana-->obeverability-->Logs.

The issue is both servers logs are got mixed and its hard to me find specific server log. If i add more than 3 or 4 server for logs monitoring so it would i be much hard to identify or search the specific server logs. Is there any way to configure each server log separately from each server in kibana so that i would be easy to find specific server log.

Experts looking forward from hearing you.

filebeat elk logstash kibana elasticsearch
1 Answers

You can use filters in the search bar to look for separate hosts.

Use a query like > beat.hostname : abc and it will filter the log stream for just the hostname "abc"

enter image description here

Tip : You can also add this hostname as a column in the log stream so that you can differentiate which log is coming from which host without even applying the filter as mentioned above.

  • GOTO Logs>>settings and find log columns options.
  • Here you can add multiple fields to be shown in the log stream. Timestamp and message should be already there by default.enter image description here
  • Add "beat.hostname" as a column.
user_64420280
Related