ECS dashboard ideas

[webmat]

In the same vein as #181, we could offer ECS dashboards that give various kinds of visibility into things. Let's note these ideas here.

We should make sure to add these dashboards to Beats when appropriate. This issue is meant to track what's independent of Beats.

[webmat]

ECS sources overview:

• display agent types & version sending ECS data
• event rate per agent
• ECS version of each source

[DeathsPirate]

I'm keen to track this, was wondering if there were some example dashboards for ECS?

[webmat]

Not shared independently so far.

You can however start with the dashboards that come with Beats 7.0. They'll be good starting points to look at ECS-formatted data streams.

Of course each module is currently filtering for their own source precisely (e.g. nginx web dashboard filters for nginx access logs). But you can start from that and expand, to look at multiple sources.

And you can keep tracking this issue, to see any further ideas for common dashboards, as well as future developments on the subject, such as when and how they'll be released.

[jamiehynds]

@djptek this issue goes back awhile, but some interesting ideas for an ECS Dashboard related to some of the telemetry you're working on.

e.g.:

• display agent types & version sending ECS data
• ECS version of each source

[djptek]

Thanks @jamiehynds

@DeathsPirate you can extract the agent types & version sending ECS data using Elasticsearch API calls e.g.

# extract the version of beats indexes

GET *beat*/_mapping?filter_path=*.mappings._meta

=>

{
  "filebeat-7.16.2-2021.12.21-000001" : {
    "mappings" : {
      "_meta" : {
        "beat" : "filebeat",
        "version" : "7.16.2"
      }
    }
  },
  "metricbeat-7.16.2-2021.12.21-000001" : {
    "mappings" : {
      "_meta" : {
        "beat" : "metricbeat",
        "version" : "7.16.2"
      }
    }
  }
}

These versions in turn can be mapped to ECS version for any given Beats version, for example metricbeat 7.16 uses ECS 1.12 see https://github.com/elastic/beats/blob/7.16/metricbeat/cmd/root.go#L46