I am new to the elastic community and need a little help.
I implemented the ELK stack and I am indexing windows event logs with winlogbeat.
For demo purposes I turned on audit logging for file shares and I get all the data I need into elastic search, but now comes my problem.
To find for example deleted files you need to filter a special event_id, result is all events with a file delete operation.
Within this result ther are ids which point to the files (in sql a classical join). So I need another filter depending on the first one to get the files which have been deleted.
I studied all the documentation about nesting, parent, child but I am still confused about solving this.
Do you have any Clou?