Is it possible to limit a user to see and search logs from a certain list of hosts with only one index?
Yes you can do index level restrictions by setting up roles for these users.
Brian
