Forum Discussion

Dark_Knight666's avatar
Dark_Knight666
Icon for Bronze III rankBronze III
29 days ago
Solved

Elastic Data Ingest: Ep.2 – Filebeat

Hello, I'm a little confused as to how to go about formulating a query for step 9?    Any advice would be greatly appreciated!
help & support
  • barney's avatar
    barney
    27 days ago

    Literally just need to put message : "group" into the KQL search bar

barney's avatar
barney
Icon for Bronze III rankBronze III
27 days ago

Literally just need to put message : "group" into the KQL search bar

  • Dark_Knight666's avatar
    Dark_Knight666
    Icon for Bronze III rankBronze III
    26 days ago

    barney​ - Thank you. Can I also please ask if you may have done something similar by trying to answer Q11?

     

     

    • barney's avatar
      barney
      Icon for Bronze III rankBronze III
      26 days ago

      I didn't do anything that clever - just compared the users returned in your previous query with the analytics dashboard that was used to answer Q7.