Hi everyone,
I work with o365 logs, and I want to make exceptions on some users, some countries etc... For example, on a dashboard, I focus on login from countries except mine, to see suspicious logs. But, if I know a user lives in India, I want to make an exception on this user with India forever. Is there a way to make exceptions on kibana that are easier to manage that this way :
The problem with this filter option is that if I have multiple dashboards and a lot of filters, it's not possible to manage correctly.
The option to pin a filter on all dashboards makes my filters disappear, so I can't use it.
The pin filter is the best option here. What do you mean with the:
The option to pin a filter on all dashboards makes my filters disappear, so I can't use it.
Another thing you could do is use the reindex api Reindex API | Elasticsearch Guide [8.11] | Elastic and create a new index with the documents you want. This means that you have to update your visualizations to use the new index though so I know that this is not the best solution.
Thank you for your quick answer. I'm going to check the API to see if it can help me.
About the pin filter, I encounter a bug when I use it. If I go on another computer to see the dashboard with the pinned filters, it makes all the filters disappear. Maybe an information that will help : if I create an exclusion filter like this one :
If the filter is not pinned, I can save my dashboard to keep the filter on this dashboard. But if I pin it, I can't save anymore. I think that it's because it's not saved on only this dashboard, but maybe that's not normal.
I've seen on internet that if you perform a hard refresh on your browser, the pinned filter disappear, and that's a problem for my use of the filters. I want to keep them during months.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
