[Auditbeat] Host Overview dashboard#10160
Conversation
|
Pinging @elastic/secops |
webmat
left a comment
There was a problem hiding this comment.
Love the looks of the dashboard.
Perhaps more useful than avg uptime would be Bottom N uptimes (most recent reboots)?
I've discovered a big worry about canonical fields for strings not being keyword indexed, but this is out of the scope of this new dashboard. Let's look into that next week.
| "enabled": true, | ||
| "id": "1", | ||
| "params": { | ||
| "field": "system.audit.host.id.keyword" |
There was a problem hiding this comment.
Hmmm, the canonical fields are not keyword datatype? Is this a fact across Auditbeat?
In ECS, we're flipping the ES convention around. Virtually all textual fields are keyword, and if full text search is needed, a multi-field named .text should be added. To take this field for example, I would have expected system.audit.host.id == keyword and system.audit.host.id.text == text.
I thought the ECS convention (at least the canonical fields being keyword) was already in place across all beats, but it seems like it's not the case here.
@cwurm Do you know how widely multi-field is used for the keyword indexing, in Auditbeat?
cc @ruflin
There was a problem hiding this comment.
My mistake. For some reason, I did not have the proper template loaded. I've loaded it now and updated the field references. Thanks for catching it.
The |
webmat
left a comment
There was a problem hiding this comment.
Happy we caught that template problem :-)
LGTM
|
Based on the screenshot I think the dashboard name needs to be swapped around. I think the convention dictates that it should be |
|
I've opened #10511 for a System Overview dashboard containing data from all datasets. So closing this for now, unless we decide to go with individual dashboards after all. |
Adds a Host Overview dashboard for data from the
hostdataset: