elastic/kibana#81551
If a user enabled the new cloud logging functionality, they will end up with a plethora of “hosts” from the logs event even if the user only has 1 endpoint enrolled.
To remediate this problem, we exclude all the elastic cloud logs from all our query inside of the security solution by using this index alias -*elastic-cloud-logs-*
If we want we can be a little bit fancier and just excluded -*elastic-cloud-logs-* when we have the alias logs-* who has been selected.