Logging from more applications in one Graylog index

Question

I am running dozens of applications and want them to push their logs into one Graylog server. I have lot of Console applications and lot of WebSites.

Website logs usually have data like BrowserAgent, URL, etc. Console applications have other kind of data.

Is it good idea to log from all these applications into one Graylog index? Each application has its own 'ApplicationName' so it is theoretically possible to distinguish the logs from each other in the search. I would like to use the benefit of searching on one place for all information.

I am worried about two things:

• does it cause problems when the index is too big because all company applications are logging into one place
• is it good idea to mix logs together where schema of the data is not identical (web logs vs. console logs)

Should I set up more instances of Graylog or is it ok to put all the stuff into one place? What are your recommendations?

thx a lot!

Answer 1

Ok I tried to put logs from All apps into one Index and it looks good. Mixing more application types seems not making any problem. In couple months I will see if it is really working good on Production.