Hello All,
I have an index with below fields and data set,
1.indicator:13.12.14.15
action:success
2.indicators:13.12.14.15
tags:elk-search
3.indicator:14.4.5.67.84
action:success
I have built a dashboard for the above with 4 panels indicator,indicators,action and tags.
Now if I search for success only 2 panels are filtering data i.e,
indicator:13.12.14.15
action:success
But I wanted data in 4 panels because success is related to 13.12.14.15 and the IP is present in one more meta called indicators which is related to tags.
To summarize if i filter success in my dashboard I need to get the below correlated data,
indicator:13.12.14.15
action:success
indicators:13.12.14.15
tags:elk-search
Is there any ways to achieve this using ELK queries? Kindly suggest your ideas as I am a beginner in writing queries.