Hello,
i have a question about dashboards delivered with Windows integration. I have created multiple new indexes and assign separate policies. example:
agent-security-logs-yyyy.mm.dd - retention 365days
agent-application-logs-yyyy.mm.dd - retention 90days
agent-system-logs-yyyy.mm.dd - retention 90days
unifi-firewall-yyyy.mm.dd - retention 365days
unifi-logs-yyyy.mm.dd - retension 90days
etc…
i wanted to use windows dasboards that are delivered with windows integration but problem is that those dashboards are pointed propably on logs-*
I tried to edit data view logs- to this: agent-security-logs-*,logs-* but it didnt worked.
Can someone help me with this?
Thanks
Jan