After some researches around the
beats input plugin and specially this rewrite I wonder if I should use only one beat input or multiples to handle multiples entry types.
I'll have events coming from roughly 500 machines, with a 20/80 windows/linux distribution. I plan to use multiples beats shipper, filebeat, metricbeat and maybe packetbeat.
Is there an interest at using one input per type/os couple or would just one input and "if type=..." in the filter pipeline be enough ?