<p>I am trying to get the audit, file beat, and metric beat logs together using Fluentd in Kibana dashboard of my kubernetes cluster. I am able to get the audit, file beat and metric beat log separately as specific indexes like filebeat-<em>, auditbeat-</em> and metricbeat-* in my Kibana dashboard.</p>

<p>Could anybody suggest me? Is there any possibility to get the above 3 types of logs within a single index? </p>

<p>Yes, assuming you are talking about an EFK stack and not an ELK stack. In your Fluentd configs you can have something like this:</p>

<pre><code>&lt;match *.**&gt;
  type copy
  &lt;store&gt;
    type elasticsearch
    host localhost
    port 9200
    include_tag_key true
    tag_key @log_name
    logstash_format true
    flush_interval 10s
    index_name fluentd.common.%Y%m%d
  &lt;/store&gt;
&lt;/match&gt;
</code></pre>

<p>They will all go to the same index <code>fluentd.common.%Y%m%d</code>, as opposed to having <code>index_name fluentd.${tag}.%Y%m%d</code>.</p>
