Fork me on GitHub
#observability
<
2022-10-24
>
timo10:10:55

Does anyone have a good way on how to separate business and technical logging? I am using an EFK-stack and buisness-logs are just interleaved with technical logs. I wonder what way I can separate them and if I need a second EFK-stack then. In the end I want our support teams to be able to access Kibana and their dashboards but they should not see the technical logs.

timo10:10:31

I am considering mulog for a future implementation of our logging.

respatialized15:10:54

You could probably set up a custom dashboard in kibana that filters out the technical stuff and share a permalink to that with your support team, a second stack for what's effectively a filter seems like overkill https://www.elastic.co/guide/en/kibana/current/reporting-getting-started.html

👍 1
ilmo16:10:22

You could also redirect to different outputs based on a particular key (json field) using eg. rewrite_tag_filter rules and labels.

👍 1
practicalli-johnny17:01:11

I recommend using mulog too. Logs would be in an easy format to filter and could easily add a key (or keys) that made the distinction between what is perceived as technical and business information I would keep all the events in one source, as the tech team can more readily connect business issues with technical activities