observability 2022-10-24

Does anyone have a good way on how to separate business and technical logging? I am using an EFK-stack and buisness-logs are just interleaved with technical logs. I wonder what way I can separate them and if I need a second EFK-stack then. In the end I want our support teams to be able to access Kibana and their dashboards but they should not see the technical logs.

I recommend using mulog too. Logs would be in an easy format to filter and could easily add a key (or keys) that made the distinction between what is perceived as technical and business information I would keep all the events in one source, as the tech team can more readily connect business issues with technical activities

I am considering mulog for a future implementation of our logging.

You could probably set up a custom dashboard in kibana that filters out the technical stuff and share a permalink to that with your support team, a second stack for what's effectively a filter seems like overkill https://www.elastic.co/guide/en/kibana/current/reporting-getting-started.html

👍 1

You could also redirect to different outputs based on a particular key (json field) using eg. rewrite_tag_filter rules and labels.

👍 1