Hello I got winlogbeat on my file server which brings up specifics ressources from an file audit, 4663, 4670 and 4659 events, well file activy actually.
I got an issue, I want to create a dashboard with the files the most used and also the folders the most used. But I just can't to this for folders, because of the filter operators :
Here is the files activity but as you can see the most used file, is actually a folder not a file. And when I'm trying to filter the data with a path, it just doesn't work at all.
I mean there is no "contains" filter, it's really embarassing, I would like to know which folders are the most used.
I'm using the "winlog.event_data.ObjectName" field which corresponds to the path of a file :
Is there currently a way to make a "contains" filter just to get all data that contains a certain path for example?
Here is what I got when I try to filter by a folder :
But it's kind of strange because the most used files in the dashboard is not a file but a folder C:\Windows\servicing\Packages
So I'm wondering why? I am not able to filter by saying "hey just give me the data thats contains this path" but the dashboard actually can wtf
I would like to get data of which folders and which files are the most used and maybe generate some report every month to get the top 250 files and top 250 folders activity.
Is it possible? If it's not, ELK is definitively useless for my use and it's sad, I am able to list which users are the most active but I can't with files and folders just because of the operators.
Does anybody has an idea?