# Graylog elasticsearch indices

**URL:** <https://community.graylog.org/t/graylog-elasticsearch-indices/5274>\
**Category:** Graylog Central (peer support)\
**Created:** [May 17, 2018, 11:32am UTC](https://community.graylog.org/t/graylog-elasticsearch-indices/5274 "2018-05-17T11:32:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mistic](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@mistic](https://community.graylog.org/u/mistic)\
**Post date:** [May 17, 2018, 11:32am UTC](https://community.graylog.org/t/graylog-elasticsearch-indices/5274/1 "2018-05-17T11:32:41Z")

</div>

Hello,

I have a question related to saving the log. I have a cluster of three graylog nodes. All the datalogs of my customers are collected in the one database. Is it possible to segregate the data for every customer to store it in different/multiple databases??

Christian

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [May 17, 2018, 11:37am UTC](https://community.graylog.org/t/graylog-elasticsearch-indices/5274/2 "2018-05-17T11:37:42Z")

</div>

> [@mistic](#):
>
> Is it possible to segregate the data for every customer to store it in different/multiple databases??

You can use streams backed by different index sets to store the messages in different indices, e. g. one index set per customer.

- [http://docs.graylog.org/en/2.4/pages/streams.html](http://docs.graylog.org/en/2.4/pages/streams.html)
- [http://docs.graylog.org/en/2.4/pages/configuration/index\_model.html](http://docs.graylog.org/en/2.4/pages/configuration/index_model.html)

---

<div class="post-metadata">

**Author:** ![mistic](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@mistic](https://community.graylog.org/u/mistic)\
**Post date:** [May 17, 2018, 11:51am UTC](https://community.graylog.org/t/graylog-elasticsearch-indices/5274/3 "2018-05-17T11:51:43Z")

</div>

Thanks for the quick response. I know that I can separate it with indexes, but all the customers data is stored in the same database location. What I wanted to have is:

Have two customers (A and B). I want that the logs of customer A are stored in database A and that customer B the datalogs stores in database B. Both databases aren’t linked together.

Can I save/store the indices to another location seprately?

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [May 17, 2018, 12:46pm UTC](https://community.graylog.org/t/graylog-elasticsearch-indices/5274/4 "2018-05-17T12:46:15Z")

</div>

You can currently only use one Elasticsearch cluster with Graylog.

This being said, you could probably build something with [shard allocation filtering](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/shard-allocation-filtering.html), so that all indices of a specific index set (customer) are stored on a pre-defined set of Elasticsearch nodes. If you do this right, each set of Elasticsearch nodes will only contain data of a specific index set (customer), but you’ll lose some flexibility.

Other than that, it might be easier to set up multiple Graylog and Elasticsearch clusters, e. g. one per customer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 31, 2018, 12:46pm UTC](https://community.graylog.org/t/graylog-elasticsearch-indices/5274/5 "2018-05-31T12:46:19Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.