Skip to content

[DOCS] Exclude cloud alias index from our query #337

@jmikell821

Description

@jmikell821

elastic/kibana#81551

If a user enabled the new cloud logging functionality, they will end up with a plethora of “hosts” from the logs event even if the user only has 1 endpoint enrolled.

To remediate this problem, we exclude all the elastic cloud logs from all our query inside of the security solution by using this index alias -*elastic-cloud-logs-*

If we want we can be a little bit fancier and just excluded -*elastic-cloud-logs-* when we have the alias logs-* who has been selected.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions