Glad it’s working! I was wondering if you could do me a favor?
Could you navigate to the Analytics > Discover menu, choose the elastiflow-flow-codex-* data source (could be ‘ecs’ instead of ‘codex’), select one record to expand (any record), and then in the details window choose ‘JSON’ and the copy icon.
If you could paste the details of that record in an email to me ( dexter at elastiflow dot com) it would be a great help. I’m trying to validate some changes and only have simulated records to work with. Having a “real” record would help me improve the scenarios I’m testing.
Thanks,
Dexter