Technical preview

The Data Quality dashboard shows you whether your data is correctly mapped to the Elastic Common Schema (ECS). Successful mapping enables you to search, visualize, and interact with your data throughout Elastic Security.

— Click to open this image in fullscreen mode

Use the Data Quality dashboard to:

• Check one or multiple indices for unsuccessful mappings, to help you identify problems (the indices used by Elastic Security appear by default).
• View the number of documents stored in each of your indices.
• View detailed information about the fields in checked indices.
• Track unsuccessful mappings by creating a case or Markdown report based on data quality results.

Check indices

When you open the dashboard, data does not appear until you select indices to check.

• Check multiple indices: To check all indices in the current data view, click Check all at the top of the dashboard. A progress indicator will appear.

• Check a single index: To check a single index, expand it using the arrow on the left. Checking a single index is faster than checking all indices.

Visualize checked indices

The treemap that appears at the top of the dashboard shows the relative document count of your indices. The color of each index's node refers to its status:

• Blue: Not yet checked.
• Green: Checked, no incompatible fields found.
• Red: Checked, one or more incompatible fields found.

Click a node in the treemap to expand the corresponding index.

Learn more about checked index fields

After an index is checked, an X (❌) or a checkmark (✅) appears in its Result column. The X (❌) indicates mapping problems in an index. To view index details, including which fields weren't successfully mapped, click the arrow next to the result.

— Click to open this image in fullscreen mode

When you expand a result, the Summary tab immediately helps you visualize the status of fields in that index. The other tabs display more details about particular fields, grouped by their mapping status.

Export data quality results

You can share data quality results to help track your team's remediation efforts. First, follow the instructions under Check indices to generate results, then either:

Export results for all indices in the current data view:

1. At the top of the dashboard, under the Check all button, are two buttons that allow you to share results. Exported results include all the data which appears in the dashboard.
2. Click Add to new case to open a new case.
3. Click Copy to clipboard to copy a Markdown report to your clipboard.

Export results for one index:

1. Expand an index that has at least one incompatible field by clicking the arrow to the left of its Result.
2. From the Summary or Incompatible fields tabs, select Add to new case to open a new case, or click Copy to clipboard to copy a Markdown report to your clipboard.