Dasboards and dataviews

Elastic Stack Kibana
1

Hello,

i have a question about dashboards delivered with Windows integration. I have created multiple new indexes and assign separate policies. example:

agent-security-logs-yyyy.mm.dd - retention 365days
agent-application-logs-yyyy.mm.dd - retention 90days
agent-system-logs-yyyy.mm.dd - retention 90days

unifi-firewall-yyyy.mm.dd - retention 365days
unifi-logs-yyyy.mm.dd - retension 90days

etc…

i wanted to use windows dasboards that are delivered with windows integration but problem is that those dashboards are pointed propably on logs-*

I tried to edit data view logs- to this: agent-security-logs-*,logs-* but it didnt worked.

Can someone help me with this?

Thanks

Jan

2

Adding an alias can help.

3

You can clone the dashboards and edit each visualization to change the data view.

But those dashboards expect some fields to exist, are the fields on the indices you created the same?