I am running dozens of applications and want them to push their logs into one Graylog server. I have lot of Console applications and lot of WebSites.
Website logs usually have data like BrowserAgent, URL, etc. Console applications have other kind of data.
Is it good idea to log from all these applications into one Graylog index? Each application has its own 'ApplicationName' so it is theoretically possible to distinguish the logs from each other in the search. I would like to use the benefit of searching on one place for all information.
I am worried about two things:
- does it cause problems when the index is too big because all company applications are logging into one place
- is it good idea to mix logs together where schema of the data is not identical (web logs vs. console logs)
Should I set up more instances of Graylog or is it ok to put all the stuff into one place? What are your recommendations?
thx a lot!
