Learn about features with demos and announcements, from cross-cluster replication and frozen indices in Elasticsearch to Kibana Spaces and the ever-growing set of data integrations in Beats and Logstash.
36. Elasticsearch is built for speed
• Every field is indexed
• Indexes built at ingest
• Denormalized data, no joins
• Distributed execution
But needs disk, cpu, memory!
42. Find users who:
• in the previous 12 months
• have used an application
• on today’s Malicious Apps list
• with param “powershell.exe”
43. Find users who:
• in the previous 12 months
• have used an application
• on today’s Malicious Apps list
• with param “powershell.exe”
Limited Join
}
44. Find users who:
• in the previous 12 months
• have used an application
• on today’s Malicious Apps list
• with param “powershell.exe”
Schema on Read}