forgerock: dashboard does not properly filter documents to be specific for ForgeRock data #14309

The dashboard does not filter at all (see line 283, 866 )

This is misleading as the data should be specific to ForgeRock. All the logs for ForgeRock have a number of forgerock.* fields. Unfortunately is not one specific to all of them. The closest is

• forgerock.eventName : all but AM_core events, IDM_core events
• forgerock.context : specific to AM_core events, IDM_core events
  The other panels filter on params forgerock-am-, forgerock-idm- (authentication,access) and are not an issue.

All panels need to filter for documents that have dataset.data_stream.dataset: forgerock or already filter on fields that ensure that only Forgerock data is presented, e.g.:

...
  "query": {
    "bool": {
      "must": [],
      "filter": [
        ...
      ]
...

to have that filter added

...
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "wildcard": {
                  "data_stream.dataset": {
                    "value": "forgerock.*"
                  }
                }
              }
            ],
            "minimum_should_match": 1
          }
        },
        ...
      ],
...