[feature request] - add dashboards for OpenSearch about fortinet-2-elasticsearch HOT 2 OPEN

That is a great idea!!! I have never used Opensearch myself tough.

May I ask, why would you use Opensearch instead of Elastic?? (besides price of course). Are there any features you may consider useful for the project that we should consider??

from fortinet-2-elasticsearch.

our reasons were mostly around cost... we needed what we considered basic features, but that are behind a very steep paywall for Elastic with their X-Pack. things like AD authentication, branding, alerting via webhook.

So we looked at hopesearch and we found it to be good enough for our needs.
for fortinet2elasticsearch i would thing that the security analytics feature could be something to look into:

https://opensearch.org/docs/latest/security-analytics/index/

otherwise data ingestion is pretty straight forward. you can use the latest logstash (we use 8.5.3, but tested with 8.6.0) , just install the output plugin logstash-output-opensearch https://github.com/opensearch-project/logstash-output-opensearch and the output section of the pipeline would look like something around those lines:

output {
  opensearch {
    hosts => [ "${OS_HOSTS}" ]
    user => "${OS_USER}"
    password => "${OS_PASSWORD}"
    cacert => '/etc/logstash/certificates/ca.crt'
    ssl => true
    index => "syslog-%{+YYYY.MM.dd}"
  }

that means that all of your ingestion/parsing should remain untouched, and the only thing to look at are (possibly) index templates and definitely at the dashboards...

from fortinet-2-elasticsearch.