There are various reasons for multiple indexes. The top few paragraphs in the docs on creating custom indexes are an easy but useful read on they why. I don't know in this particular case why there would be four indexes, but in other apps I've found the primary reasons are for control of retention or permissions. For instance, the configuration changes your firewall is reporting in may need both a different retention and also a different set of people reviewing them than the actual traffic your firewall is reporting needs.
