I am having ELK setup of 7.4.2 on linux.
I am stuck between creating spaces in kibana.
For eg: I have 4 devices of data pushing to one index i.e., filebeat. I want to create sapace of 4 different device ie., Palto Alto, Netscaler, Mcafee, Forcepoint from one index.
But when I am creating Palto Alto spaces and loading the index of filebeat, It is giving me all the 4 devices of logs.
How to create spaces role assigned on fields.