I was curious about working with
DSL queries, so I made some tests and I found something strange.
I have a
winlogbeat-security index which contains windows security events and I am searching logs with the following term
"Échec de l’audit" in a specific range.
However, when I am using
DSL query I didn't have the same result as the
Look at the first picture :
Here I am using
KQL with Kibana interface and I got 1553 hits.
On the second picture we can see the same query but I have only 119 hits.
If you have any ideas I will be happy to read you
Thank you !