Forum Discussion

Dark_Knight666's avatar
Dark_Knight666
Silver I
4 months ago
Solved

Elastic Data Ingest: Ep.2 – Filebeat

Hello, I'm a little confused as to how to go about formulating a query for step 9?    Any advice would be greatly appreciated!
help & support
  • barney's avatar
    barney
    4 months ago

    Literally just need to put message : "group" into the KQL search bar

barney's avatar
barney
Bronze III
4 months ago

Literally just need to put message : "group" into the KQL search bar

  • Dark_Knight666's avatar
    Dark_Knight666
    Silver I
    4 months ago

    barney​ - Thank you. Can I also please ask if you may have done something similar by trying to answer Q11?

     

     

    • barney's avatar
      barney
      Bronze III
      4 months ago

      I didn't do anything that clever - just compared the users returned in your previous query with the analytics dashboard that was used to answer Q7.