Hi,
I am pretty new to ELK but I've managed to setup a full stack and now just recently begun playing around with some visualization. This is my current dashboard:
My question is this: In the "FailedLogon" panel is there any way to specify which fields to display in the result? Right now I get the whole event. Instead I would like to display just the username and server.
Sorry if it is a newbie question, but I have not managed to find any good answers when I've searched.
Thanks in advance.