Hello! Just install Elaticsearch & Kibana & Auditbeat (Ubuntu Server 20.04). Also install auditbeat dashboard. But [Auditbeat System] Login Dashboard ECS is empty. I want to see user login count. Some browsing bring me to understanding, that this dashboard require "Event.dataset: login" field. But in my case user login event doesn't contain this section (also for user section). Event.dataset: file & host is working. This datasets is enable in auditbeat.yml:
- module: system datasets: - host # General host information, e.g. uptime, IPs - login # User logins, logouts, and system boots. - process # Started and stopped processes - user # User information
How I can enable event.dataset:login field?