I'm evaluating the ELK stack with filebeat & logstash across a diverse range of applications/ servers.
I understand the power of customising my own grok patterns for each application/log, but to get running initially it seems very inefficient to hand craft my own pattern for each application, when surely it's been done before me!
The filebeat bundled dashboards seems to create dashboard based on fields which I need to hand craft myself in logstash (e.g.
system.auth.sudo.command). Is there a better way with more 'batteries included' I am missing?