When I saw “haystack” I had a feeling it would be a little too CTF for my taste. User was irritating because I thought I was pulling everything when I was only pulling about 10 records or so. Nobody’s fault but my own. When I got that root was pretty fun. I didn’t know much about the ELK stack so this was a great learning experience. Thanks for this!