Event.dataset: login not present

Hello! Just install Elaticsearch & Kibana & Auditbeat (Ubuntu Server 20.04). Also install auditbeat dashboard. But [Auditbeat System] Login Dashboard ECS is empty. I want to see user login count. Some browsing bring me to understanding, that this dashboard require "Event.dataset: login" field. But in my case user login event doesn't contain this section (also for user section). Event.dataset: file & host is working. This datasets is enable in auditbeat.yml:

- module: system
  datasets:
    - host    # General host information, e.g. uptime, IPs
    - login   # User logins, logouts, and system boots.
    - process # Started and stopped processes
    - user    # User information

How I can enable event.dataset:login field?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.