[Corelight][Aggregation] Add support of aggregation logs in Data Explorer dashboards

[sharadcrest]

Type of change

• Enhancement

Proposed commit message

• Add support for visualizing aggregation logs in the Data Explorer dashboard category.
• Introduce an Aggregation filter to allow switching between aggregated and non-aggregated log views.
• Default dashboard view displays non-aggregated logs.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/corelight directory.
• Run the following command to run tests.

elastic-package test

2026/07/22 18:44:06  INFO New version is available - v0.125.1. Download from: https://github.com/elastic/elastic-package/releases/tag/v0.125.1
Run asset tests for the package
--- Test results for package: corelight - START ---
╭───────────┬─────────────┬───────────┬────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE   │ DATA STREAM │ TEST TYPE │ TEST NAME                                                          │ RESULT │ TIME ELAPSED │
├───────────┼─────────────┼───────────┼────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ corelight │             │ asset     │ dashboard corelight-023162b6-94da-4d8d-b1f6-de6192356cce is loaded │ PASS   │      2.797µs │
│ corelight │             │ asset     │ dashboard corelight-0cfc8a95-4979-4265-b9ad-91edf63f01a9 is loaded │ PASS   │        206ns │
│ corelight │             │ asset     │ dashboard corelight-2d4dc345-cbbe-4d7a-9203-5ab11c8cb5ba is loaded │ PASS   │        180ns │
│ corelight │             │ asset     │ dashboard corelight-323b0f27-993e-4fee-ae6e-b5977d7cab11 is loaded │ PASS   │        215ns │
│ corelight │             │ asset     │ dashboard corelight-3a4a279f-f238-47de-90ba-f643c5647fde is loaded │ PASS   │        226ns │
│ corelight │             │ asset     │ dashboard corelight-40bbc19b-dd9c-4b43-a88a-e29fc8701902 is loaded │ PASS   │        205ns │
│ corelight │             │ asset     │ dashboard corelight-45197477-c13f-4e52-a5dd-fb4f53564963 is loaded │ PASS   │        247ns │
│ corelight │             │ asset     │ dashboard corelight-58885f47-95e1-4242-a1ee-783de69ace17 is loaded │ PASS   │        265ns │
│ corelight │             │ asset     │ dashboard corelight-64c6d5b5-a485-4f00-b24f-6c261d595db4 is loaded │ PASS   │        270ns │
│ corelight │             │ asset     │ dashboard corelight-65a5fa91-06e4-459b-b4bb-998c85a6cf08 is loaded │ PASS   │        287ns │
│ corelight │             │ asset     │ dashboard corelight-7c0946bc-acd0-4ec3-ab3b-8a92853f4a3b is loaded │ PASS   │        311ns │
│ corelight │             │ asset     │ dashboard corelight-8546a96c-86c9-4edf-9d46-88338d6ac40e is loaded │ PASS   │        329ns │
│ corelight │             │ asset     │ dashboard corelight-8c5f15f7-7063-4228-be54-fb8c20b29caa is loaded │ PASS   │        350ns │
│ corelight │             │ asset     │ dashboard corelight-caf92ff9-71b9-402c-813a-75ba5a3cb3b8 is loaded │ PASS   │        507ns │
│ corelight │             │ asset     │ dashboard corelight-e4a93cfe-4b1f-44df-ab99-50c74f6f2203 is loaded │ PASS   │        375ns │
│ corelight │             │ asset     │ dashboard corelight-eff0434c-1e27-4c02-959e-9f5d95488efb is loaded │ PASS   │        393ns │
│ corelight │             │ asset     │ dashboard corelight-f1208ffe-d168-46d1-9531-24de523d1bfb is loaded │ PASS   │        445ns │
│ corelight │             │ asset     │ dashboard corelight-f4864774-ed73-4b78-b861-5b8235ec12cf is loaded │ PASS   │     84.852µs │
│ corelight │             │ asset     │ dashboard corelight-f7da14f0-85db-48e8-a591-1f650af0f618 is loaded │ PASS   │        421ns │
│ corelight │             │ asset     │ dashboard corelight-ff07e65c-2703-4cbe-a45f-3881025352a3 is loaded │ PASS   │        469ns │
│ corelight │             │ asset     │ search corelight-039807c4-9ec2-4778-b548-0e08877fb8d2 is loaded    │ PASS   │        464ns │
│ corelight │             │ asset     │ search corelight-25c4969f-1368-433e-905d-fda0ae7e4923 is loaded    │ PASS   │        269ns │
│ corelight │             │ asset     │ search corelight-845d2914-3a55-4057-9dca-a3fd4e226d54 is loaded    │ PASS   │        286ns │
│ corelight │             │ asset     │ search corelight-92c0bf7d-5abe-46a1-800d-281386e4b219 is loaded    │ PASS   │        282ns │
│ corelight │             │ asset     │ search corelight-9d31f033-1900-47c6-b7cf-f34a9c00c2d6 is loaded    │ PASS   │        325ns │
│ corelight │             │ asset     │ search corelight-9eee7e02-dea8-4e4b-9dc1-9d1df9785aef is loaded    │ PASS   │        296ns │
│ corelight │             │ asset     │ search corelight-a44be701-0e99-4b53-9073-b7720df40481 is loaded    │ PASS   │        347ns │
│ corelight │             │ asset     │ search corelight-e0f9718e-23ec-4c36-8040-d687fc177db4 is loaded    │ PASS   │        365ns │
╰───────────┴─────────────┴───────────┴────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: corelight - END   ---
Done
Run pipeline tests for the package
--- Test results for package: corelight - START ---
No test results
--- Test results for package: corelight - END   ---
Done
Run policy tests for the package
--- Test results for package: corelight - START ---
No test results
--- Test results for package: corelight - END   ---
Done
Run script tests for the package
--- Test results for package: corelight - START ---
--- Test results for package: corelight - END ---
Done
Run static tests for the package
--- Test results for package: corelight - START ---
No test results
--- Test results for package: corelight - END   ---
Done
Run system tests for the package
--- Test results for package: corelight - START ---
No test results
--- Test results for package: corelight - END   ---
Done

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.