Very valid points! Thanks for bringing this up, definitely something to think about also in the context of having standard logging schema with Kibana visualizations to go with it

I've ported the "host firewall" dashboard to ECS and here's my experience so far:

• visualizations are backed / attached to the ecs-* index pattern, not a saved search. This makes the visualizations reusable across dashboards.
• so far I've needed only visualizations essentially based on a single field. In that case I've named the visualization as FIELDNAME - AGGREGATION where aggregation is usually one of:
  • count - a data table with the summary of FIELDNAME
  • over time - area visualization (bars) broken down on FIELDNAME on y axis and aggregated by @timestamp on x axis
  • top N over time - same as above, but top N

I'm sure there's more to do, especially for visualizations based on more than one field, more use cases for aggregations and saved searches naming. The above should be good enough as a starting point, what do you think @colewhite @ayounsi ? Also as we port more and more things to ECS we'll get a better idea of what we need.

I think it makes sens!

In T249607#6852786, @fgiunchedi wrote:

• so far I've needed only visualizations essentially based on a single field. In that case I've named the visualization as FIELDNAME - AGGREGATION where aggregation is usually one of:
  • count - a data table with the summary of FIELDNAME
  • over time - area visualization (bars) broken down on FIELDNAME on y axis and aggregated by @timestamp on x axis
  • top N over time - same as above, but top N

I think this is a great start and definitely gets the ball rolling. Thank you for this!

Another thing to consider is we will encounter sub-aggregations fairly often, but not nearly as common as single field visualizations. In this example, the visualization consists of counting @timestamp and splitting the series on host.

In T249607#6855061, @colewhite wrote:

In T249607#6852786, @fgiunchedi wrote:

• so far I've needed only visualizations essentially based on a single field. In that case I've named the visualization as FIELDNAME - AGGREGATION where aggregation is usually one of:
  • count - a data table with the summary of FIELDNAME
  • over time - area visualization (bars) broken down on FIELDNAME on y axis and aggregated by @timestamp on x axis
  • top N over time - same as above, but top N

I think this is a great start and definitely gets the ball rolling. Thank you for this!

Another thing to consider is we will encounter sub-aggregations fairly often, but not nearly as common as single field visualizations. In this example, the visualization consists of counting @timestamp and splitting the series on host.

Indeed, I ran into this use case too, perhaps it wasn't clear but that's what over time addresses (i.e. @timestamp + FIELDNAME)