# How can i create dashboard for openedr logs similare to openedr dashboard

**URL:** <https://discuss.elastic.co/t/how-can-i-create-dashboard-for-openedr-logs-similare-to-openedr-dashboard/359460>\
**Category:** Kibana\
**Created:** [May 14, 2024, 12:46pm UTC](https://discuss.elastic.co/t/how-can-i-create-dashboard-for-openedr-logs-similare-to-openedr-dashboard/359460 "2024-05-14T12:46:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sandraimmaculate](https://avatars.discourse-cdn.com/v4/letter/s/b487fb/32.png) [@sandraimmaculate](https://discuss.elastic.co/u/sandraimmaculate)\
**Post date:** [May 14, 2024, 12:46pm UTC](https://discuss.elastic.co/t/how-can-i-create-dashboard-for-openedr-logs-similare-to-openedr-dashboard/359460/1 "2024-05-14T12:46:29Z")

</div>

hi,  
i parsed the logs from openedr to elk using filebeat it get parsing!

1. `_id`: Unique identifier for the log entry.
2. `_index`: Index name where the log entry is stored.
3. `_score`: Score of the log entry (typically used in search results).
4. `@timestamp`: Timestamp of when the log entry was recorded.
5. `@version`: Version of the log entry.
6. `agent.ephemeral_id`: Ephemeral identifier for the agent responsible for collecting the log entry.
7. `agent.id`: Identifier for the agent responsible for collecting the log entry.
8. `agent.name`: Name of the agent responsible for collecting the log entry.
9. `agent.type`: Type of agent responsible for collecting the log entry.
10. `agent.version`: Version of the agent responsible for collecting the log entry.
11. `ecs.version`: Version of the ECS (Elastic Common Schema) used.
12. `event.original`: The original event data before parsing.
13. `host.architecture`: Architecture of the host system.
14. `host.hostname`: Hostname of the system where the event occurred.
15. `host.id`: Unique identifier for the host system.
16. `host.ip`: IP addresses associated with the host system.
17. `host.mac`: MAC address of the host system.
18. `host.name`: Name of the host system.
19. `host.os.build`: Build version of the operating system.
20. `host.os.family`: Family of the operating system (e.g., Windows).
21. `host.os.kernel`: Kernel version of the operating system.
22. `host.os.name`: Name of the operating system.
23. `host.os.platform`: Platform of the operating system (e.g., Windows).
24. `host.os.type`: Type of operating system (e.g., Windows).
25. `host.os.version`: Version of the operating system.
26. `input.type`: Type of input used to collect the log entry.
27. `log.file.idxhi`: High index of the log file.
28. `log.file.idxlo`: Low index of the log file.
29. `log.file.path`: Path of the log file.
30. `log.file.vol`: Volume of the log file.
31. `log.offset`: Offset within the log file where the entry was read.
32. `parsed_json.baseEventType`: Base event type.
33. `parsed_json.baseType`: Base type.
34. `parsed_json.childProcess.*`: Information about child processes.
35. `parsed_json.customerId`: Customer ID.
36. `parsed_json.deviceName`: Name of the device.
37. `parsed_json.endpointId`: Endpoint ID.
38. `parsed_json.processes.*`: Information about processes.
39. `parsed_json.sessionUser`: User associated with the session.
40. `parsed_json.time`: Time associated with the parsed JSON.
41. `parsed_json.type`: Type of parsed JSON.
42. `parsed_json.version`: Version of parsed JSON.
43. `tags`: Additional tags applied to the log entry.  
these many fields i'm able to see in discover of openEDR logs

will i able create a dashboard like in below formate with malware detection

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aa3549ab7401ed0d3132599bfb4bdf913a989b5a.jpeg)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/a/5a7a0915ec3c83d49a82490e41249461a68cc9d2.png)

---

<div class="post-metadata">

**Author:** ![sandraimmaculate](https://avatars.discourse-cdn.com/v4/letter/s/b487fb/32.png) [@sandraimmaculate](https://discuss.elastic.co/u/sandraimmaculate)\
**Post date:** [May 15, 2024, 5:05am UTC](https://discuss.elastic.co/t/how-can-i-create-dashboard-for-openedr-logs-similare-to-openedr-dashboard/359460/2 "2024-05-15T05:05:32Z")

</div>

please suggest