title: Are there conventions for naming/organizing Elasticsearch indexes which store log data?
body: <p>I'm in the process of setting up Elasticsearch and Kibana as a centralized logging platform in our office. </p>
  
  <p>We have a number of custom utilities and plug-ins which I would like to track the usage of and if users are encountering any errors. Not to mention there are servers, and scheduled jobs I would like to keep track of as well.</p>
  
  <p>So if I have a number of different sources for log data all going to the same elasticsearch cluster what are the conventions or best practices for how this is organized into indexes and document types? </p>
  
  <p>The default index value used by Logstash is <code>"logstash-%{+YYYY.MM.dd}"</code>. So it seems like it's best to suffix any index names with the current date, as this makes it easy to purge old data.</p>
  
  <p>However, Kibana allows for adding multiple "index patterns" that can be selected from in the UI. Yet all the tutorials I've read only mention creating a single pattern like <code>logstash-*</code>. </p>
  
  <p>How are multiple index patterns used in practice? Would I just give names for all the sources for my data? Such as:</p>
  
  <pre><code>BackupUtility-%{+YYYY.MM.dd}
  UserTracker-%{+YYYY.MM.dd}
  ApacheServer-%{+YYYY.MM.dd}
  </code></pre>
  
  <p>I'm using <a href="http://nlog-project.org" rel="noreferrer">nLog</a> in a number of my tools which has an <a href="https://github.com/ReactiveMarkets/NLog.Targets.ElasticSearch" rel="noreferrer">elastic search target</a>. The convention for nLog and other similar logging frameworks is to have a "logger" for each class in the source code. Should these logger translate to indexes in elastic search? </p>
  
  <pre><code>MyCompany.CustomTool.FooClass-%{+YYYY.MM.dd}
  MyCompany.CustomTool.BarClass-%{+YYYY.MM.dd}
  MyCompany.OtherTool.BazClass-%{+YYYY.MM.dd}
  </code></pre>
  
  <p>Or is this too granular for elasticsearch index names, and it would be better to stick to just to a single dated index for the application?</p>
  
  <pre><code>CustomTool-%{+YYYY.MM.dd}
  </code></pre>