Best Praxis? Sidecar -> Stream ->Dashboard

[gsmith]

Hello,
Perhaps I can help.

@Matthias23

In the Dashboard i would like to to have a Message Table for each of the winlogbeat_event_provider
for Apllication, 1 for System and 1 for Security logs.
What is the best way to achieve this?

I’ll show ya some screenshots.

1.Navigate to you message from Winlogbeat.

2.Click on the arrow next to winlogbeat_winlog_channel, this opens a new window

3.Choose Show top Value

4.Now you have a widget with all your channels

5.From there you can move/make your dashboards by click on the arrow next to the channel name ( System Application, etc…) and then choose Show Documents for value

Hope that helps