Hi,
I just wanted to ask if I’m doing this right or not? I basically create a new configuration for each type of log, even though all of them listen on the same beats port of 5044.
For example I have a configuration like this:
apache-logs
auth-logs
both are beats, so under apache-logs, I have an input and output configured. The same for auth-logs. Is it right to have them separate like this?
Or should I make just one configuration like:
linux-logs
and then inside create all the inputs/outputs for apache logs, auth logs, etc, etc?