Using Pre-Built Visualizations with Views

After you create views for your object groups and their indexed data, you can query them using the Search Analytics > Discover page as well as create visualizations and dashboards for graphical display of important information.

ChaosSearch includes the ability to associate some pre-built visualizations with your views. There are pre-built definitions available for AWS CloudTrail, CloudFlare, ELB, Fastly, and VPC Flow Logs.

There are also some custom JSON visualization templates in the following sections for Fastly, Slack, Nginx, and VPC Flow Logs that offer a starting point for users of those applications/services. You can import the NDJSON files for these applications using the Search Analytics > Configuration page; the system will prompt you for the correct view name to use in your environment.

The pre-built visualizations are designed to work with the indexed data for each log type, but keep in mind that edits might be needed to the visualizations if they reference columns that are not found in the associated view. In some cases, the visualization might need only a minor edit to change/update a column name. In other cases, the expected column might not be part of the view, and the pre-build visualization might not be useful for your environment, or for that specific view. You can try them in your system to see if they might be helpful for your users who analyze that type of information.