You've got a fancy new Brothers DCPL2550DW printer for the office. It connects to wireless just fine, you're able to add it to Windows, you're able to print from your iPhone via AirPrint, and... it just stops responding. You walk over, reset the printer, everything is great again, and... it stops responding again. I went through all types of wireless and mDNS troubleshooting before finding the answer.

Meet Deep Sleep

Here's the thing: I swear this used to work just fine. I'm guessing these issues are related to a firmware update that was applied a few months back. Unfortunately, the deep sleep function is a bit too aggressive since a wireless connection to the printer doesn't wake it back up. Here's how you disable deep sleep:

1. Click the Menu button.
2. Click the OK  button while on 1. General Setup which should be the first option.
3. Click the Down/Minus button once to get to 2. Ecology and click the OK button.
4. Click the Down/Minus button twice to get to 3. Sleep Time and click the OK button. It'll say 1 Minues by default.
5. Click the Down/Minus button at the same time as the Stop/Exit button. It will now display Deep Sleep on the LCD.
6. Change it to Off and click OK.
7. Unplug the printer and plug it back in.

At that point you should be good to go. I have no idea how this was missed by Brothers QA since it's a pain to deal with.

I'm a fan of Blue Iris for security camera recording. It's relatively easy to configure, supports a ton of cameras, and constantly adds new features. However, the downside is that it's robust motion detection is just that: motion detection. You'll get alerts on shadows, trees moving, cars driving, by etc. Me? I just want to get alerted on certain objects like people, cars, and the occasional bicycle. I don't care about the generic motion alerts.

Enter DeepStack for object-based detection, which has recently been incorporated into Blue Iris. Blue Iris will detect generic motion, pass it to DeepStack for further analysis, and DeepStack will let you know if there's an actual person, bike, vehicle, etc in the video capture that's being analyzed. Each Blue Iris camera has configurable settings around the types of DeepStack detection too.

Now, there is a version of DeepStack that runs on Windows. You could technically have Blue Iris side-by-side with DeepStack on the Windows server if you've got enough horsepower for both. Unfortunately I don't. Instead, I'm going to be running DeepStack on my Arch Linux Docker server that has some free resources.

This guide will walk you through the configuration steps.

Configuring DeepStack in Docker

Keep in mind that I'm assuming that you already have a server running Docker. This Docker server is where we'll be running the DeepStack container. You'll need two components, docker and docker-compose, to get this deployed. The first step is to create a "home directory" where DeepStack will like: one for the docker-compose.yml file, the other for the DeepStack storage directory.

Create the initial directories:

sudo mkdir -p /opt/dockerfiles/deepstack/
sudo mkdir -p /opt/deepstack/

Create the initial .env file for docker-compose:

sudo vi /opt/dockerfiles/deepstack/.env

# Add the following to the file. Customize as needed.
# Your timezone, https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
TZ=America/Detroit
PUID=1000
PGID=1000
# The directory where data and configuration will be stored.
ROOT=/opt

Next create the docker-compose.yml file that you'll need. Please note that you can customize the port15000 for where you'll connect from Blue Iris. For example, if your Docker server is docker.env.internal, then your DeepStack server would reside at http://docker.env.internal:15000.

vi /opt/dockerfiles/deepstack/docker-compose.yml

# Add the following lines to the file. 

version: "3.3"

services:
  deepstack:
    image: deepquestai/deepstack:latest
    restart: unless-stopped
    container_name: deepstack
    ports:
      - "15000:5000"
    environment:
      - TZ=${TZ}
      - PUID=${PUID}
      - PGID=${PGID}
      - VISION-SCENE=True
      - VISION-FACE=True
      - VISION-DETECTION=True
    volumes:
      - ${ROOT}/deepstack:/datastore

The next step is enabling the DeepStack container. Simply do the following:

cd /opt/dockerfiles/deepstack

# To bring up the stack:
sudo docker-compose up -d

# To take down the stack:
sudo docker-compose down

# To watch the logs from the container:
sudo docker logs -f deepstacker

# Ultimately you'll want to bring up the container though:
sudo docker-compose up -d

...and bam, you should have a DeepStack container running in Docker. Keep in mind this is the CPU version. It's fast enough and not as picky as the GPU version. You'll eventually see the screenshot below if you run the logs command above while Blue Iris is detecting motion.

Each one of those lines is a request submitted to DeepStack from Blue Iris, along with the time it took to process the image. Now, let's configure Blue Iris to connect to the DeepStack server.

Configuring Blue Iris to Connect to DeepStack

This is part is simple. Go into Blue Iris and click on the settings icon. When the menu pops up, click on the AI tab.

You'd then plug in the DeepStack settings for Blue Iris. There isn't much to this. The DeepStack server on IP/port: should be the hostname of the docker server, followed by the port you'd configured, e.g. docker.env.internal and 15000. Make sure the items in the screenshot below are checked.

Finally, click OK on the bottom. Next you'll need to configure each camera to utilize the DeepStack integration. It's not difficult: motion is detected by Blue Iris, Blue Iris sends the image to DeepStack, DeepStack sends the results back to Blue Iris, and Blue Iris determines if it's an alert.

Open up the camera settings, go to Trigger, and ensure Motion sensor is checked. You can then click on Configure.

I just keep mine at reasonable defaults to ensure general motion will trigger the motion sensor. You can keep everything else unchecked unless you actually need it.

Click OK when done. Next, click on the Artificial Intelligence... button on the Trigger tab for the camera.

On in the Artificial Intelligence section, there are only a few items that need to be changed. I'd recommend changing To confirm to just person if you only care about person detection. You can also change the minimum confidence. I've had good luck with 70%. Everything else can be left at defaults. Click OK when done.

Click OK again on the camera settings screen from before. You'll see the camera feed quickly restart. Congrats, you have DeepStack enabled for the camera.

What Happens Next?

Well, when a generic motion alert happens, you'll notice a few things:

1. The thumbnail for the alert will briefly appear in the alerts list in Blue Iris.
2. It'll (1) sit there for a second and disappear, or (2) remain in the alert list with a person:N% listed next to the thumbnail.

The TL;DR version is that any motion alerts not matching the DeepStack detection will get removed from the alert list, e.g. the alert only persists if DeepStack says there's a 78% chance that there's a person in the fame. Much better detection, and almost zero false positives. Hope this helps!

This is just a quick time-lapse of 100 rounds of 40 S&W being reloaded. It's definitely not my favorite round to reload, but overall the shooting experience is much more tolerable with a new Glock 23 Gen 5 MOS. The same rounds out of an M&P Shield are like slapping your hand on concrete. Much, much smoother with the Glock. For reference:

Here's the recipe for the rounds being reloaded:

| Key          | Value      |
| ------------ | ---------- |
| Caliber      | 40 S&W     |
| Bullet GR    | 180        |
| Bullet Type  | HP         |
| Powder Brand | Unique     |
| Powder GR    | 6.4        |
| C.O.A.L      | 1.131      |
| FPS          | 1096       |
| Date Tested  | 03/27/2021 | 

And finally the time-lapse. The actual reloading time was about 15 minutes, or roughly 9 seconds a round.

Happy reloading!

I was looking at the tags I've used, found one listed as #dirt, and realized that it was almost a year ago that I had the genius idea of moving 10 yards of dirt by myself. Apparently I haven't learned anything since I just did the same with 10 yards of mulch. The end result is great, but I have no idea why I keep doing this to myself.

The beginning:

The end:

This is a follow-up to my previous article on Notion. I'll preface this with 3 points: (1) my knowledge and productivity software changes as frequently as my socks, (2) there is nothing inherently wrong with Notion, and (3) I've accepted the fact that I'll never be happy with any single platform.

That being said, I was recently burned by an outage with Notion. The joy of a cloud-based information management platform is that you shouldn't need to worry about losing your data. The downside is that when it's down, it's down, and you don't have access to your notes or data. Unfortunately, I was in the latter category right before a meeting, so I ended up searching for a "local" knowledge repository.

Enter Obsidian.

What is Obsidian?

That's probably easiest to describe from their website: Obsidian is a powerful knowledge base that works on top of a local folder of plain text Markdown files.

Super clear and I can just quit typing, right? Yeah, probably not. I didn't really understand it at first either. Try this: imagine a not-slowly-dying Evernote, combined with a markdown editor, mixed with extensive information and knowledge mapping, and sprinkled with a bunch of tools and plugins to make sense of your data. In reality, you'd likely build a Frankenstein's monster that would smash your desk and shatter your iPad. Instead, you get... Obsidian, and most importantly, it's really good at what it does.

How Does Obsidian Work?

At a simple level: you dump lots of data and notes into Obsidian, leverage markdown for formatting, add some level of tagging and internal links, and Obsidian starts to make sense of the data and shows how everything is related. There are also a ton of plugins that can ride on top of the data to provide additional functionality. I'll cover the useful ones I've found later in the article. However, rather than trying to reinvent the wheel by explaining Obsidian, I'll link to an outstanding video series that covers the basics in 12 minutes:

How Do I Get My Notes Into Obsidian?

Easy! They have a desktop application. You can also sign up for insider build if you're a contributor. Best of all, the notes are simple markdown files that will work with any text editor. I store mine in Google Drive, but any storage provider should work just fine.

The only downside is a lack of a mobile application. There is one in development though, which is supposed to be released shortly. In my case it doesn't really matter: it's rare that I'm taking notes from my phone. When I do, I simply use Nebo or Apple Notes. The rough draft of the notes then gets copied, pasted, cleaned up, and added to Obsidian. In the end they're markdown files and can be opened with just about any editor.

How Do I Organize My Data?

That's really up to you. Obsidian is extremely open and flexible for how you organize your data. Here are a few tips I've picked up over the last few months.

Tags Are For Searching

Tags make it simple to search through your data, e.g. find everything that matches #pilot-notes. This also factors into the graph view since you can quickly isolate the graph down to specific tags. A recent trick I've found is that you can use "nested tags" to improve organization. For example: #pilot/notes, #pilot/active, #pilot/closed, etc. You end up with a nice tree of tags in the navigation pane:

Internal Links Are For Knowledge

Basically, any major "concepts" should be placed between [[ and ]]. For example, if I've got running notes on a particular customer, I'd always place [[Customer ABC]] in my notes like that. Why? Because then I can quickly find how they're all related. You're essentially building a bunch of internal links on that particular concept or topic. It'll also autocomplete after you type [[ in your notes, which makes it easy to ensure you're always using the same topic.

Templates Are Your Friend

Templates in Obsidian are outstanding. They allow you to quickly add the groundwork to a note without having to type everything out again. Let's say I'm adding a new contact into my notes. I'll hit CRTL+T which I have mapped to the "insert template" function, start to type "contact", and it'll bring up my contact template. Templates look something like this:

---
created: {{date:LLL}}
tags: [contacts]
---

| Key     | Value |
| ------- | ----- |
| Name    |       |
| Company |       |
| Title   |       |
| Email   |       |
| Mobile  |       |
| Office  |       |

You may be wondering about that text at the beginning: it's called front matter in YAML terms. I'll explain below.

Front Matter Helps You Organize

Obsidian has a short tutorial on front matter. It's essentially metadata for your notes. The front matter in the template above will insert the date, e.g. created: March 2, 2021 2:34 PM, and automatically add a #contacts tag. It'll look something like this depending on your settings:

File and Folder Organization Is Optional

I cringe when I see people who dump all of their notes and attachments into a single folder. Fortunately, Obsidian doesn't really care about the directory structure in the "vaults" that it uses for notes. I still keep mine organized just because of personal preference.

Useful Community Plugins

As of typing this, there are around 160 "community plugins" for Obsidian. These are contributed by users in the community. The application makes it painless to get them installed: it's literally just a few clicks in the UI. These are the ones that I use regularly.

Advanced Tables

It makes formatting tables in markdown much, much easier. At this point I actually prefer markdown tables to "real" tables that you'll find in Excel. This is basically a must-have plugin, to the point that I'd love to see it baked into the application itself.

Checklist

This will scan through your notes, look for any checklists, and display them in the sidebar. It's great if you take daily notes and have checklist items that are unresolved at the end of the day. For reference, a checklist item looks like this when it's done in markdown:

- [ ] This is an unchecked item.
- [ ] This is another one.
- [x] This is a checked item.

Find Unlinked Files and Unresolved Links

This will scan through your notes and find anything that's unlinked. As an example, let's say I'm working on a project but haven't created a dedicated page for it, e.g. I've got [[My Project]] scattered all through my notes but never created a centralized page. This plugin will list out all of your files and links that are referenced but don't exist.

Note Refactor

This plugin is great if you use something like Daily Notes as your scratch pad. You can highlight chunks of text and "refactor" them into a dedicated page. The plugin takes care of the links between the two.

Closing Remarks

Hopefully this gets you started down the path of using Obsidian. Fortunately, there is no "right or wrong" path with using Obsidian, just lots of recommendations. I've been using it for 2-3 months without any issues or complaints. Hope this helps!

Around 15 years ago, a co-worker suggested that I look into reloading as a hobby. I knew nothing about the topic at the time. He suggested going the buy once cry once route: spend lots of money up-front for decent equipment, and you won't have to worry about replacing it later. I ended up ordering a Dillon 550B. It wasn't cheap, but it's held up amazingly well and is still the only reloading press that I own.

Fast-forward to present day. I picked up a ProChrono DLX Chronograph for measuring the speed of my rounds. It works extremely well: shoot, wait for the measurement, shoot, wait for the measurment, etc. You then use their app to pull all the shot strings onto your phone via Bluetooth. Honestly, I have no idea why I waited so long to purchase one.

That being said, I figured it was time to share all of my 300 BLK recipes and the associated data. Enjoy.

300 BLK - 125 GR - 1585 FPS

| Key          | Value      |
| ------------ | ---------- |
| Caliber      | 300 BLK    |
| Bullet GR    | 125        |
| Bullet Type  | Sierra HP  |
| Powder Brand | CFE BLK    |
| Powder GR    | 19.5       |
| C.O.A.L      | 2.060      |
| FPS          | 1585       |
| Date Tested  | 02/26/2021 |

• Bullet Drop Card.
• Chronograph Data.

300 BLK - 125 GR - 1804 FPS

| Key          | Value      |
| ------------ | ---------- |
| Caliber      | 300 BLK    |
| Bullet GR    | 125        |
| Bullet Type  | Sierra HP  |
| Powder Brand | CFE BLK    |
| Powder GR    | 20.8       |
| C.O.A.L      | 2.231      |
| FPS          | 1804       |
| Date Tested  | 02/13/2021 |

• Bullet Drop Card.
• Chronograph Data.

300 BLK - 125 GR - 1834 FPS

| Key          | Value      |
| ------------ | ---------- |
| Caliber      | 300 BLK    |
| Bullet GR    | 125        |
| Bullet Type  | Sierra HP  |
| Powder Brand | CFE BLK    |
| Powder GR    | 21.0       |
| C.O.A.L      | 2.220      |
| FPS          | 1834       |
| Date Tested  | 02/28/2021 |

• Bullet Drop Card.
• Chronograph Data.

300 BLK - 155 GR - 1647 FPS

| Key          | Value       |
| ------------ | ----------- |
| Caliber      | 300 BLK     |
| Bullet GR    | 155         |
| Bullet Type  | Sierra HPBT |
| Powder Brand | CFE BLK     |
| Powder GR    | 20.0        |
| C.O.A.L      | 2.235       |
| FPS          | 1647        |
| Date Tested  | 02/06/2021  |

• Bullet Drop Card.
• Chronograph Data.

300 BLK - 208 GR - 969 FPS

| Key          | Value       |
| ------------ | ----------- |
| Caliber      | 300 BLK     |
| Bullet GR    | 208         |
| Bullet Type  | Sierra HPBT |
| Powder Brand | CFE BLK     |
| Powder GR    | 11.9        |
| C.O.A.L      | 2.250       |
| FPS          | 969         |
| Date Tested  | 02/06/2021  |

• Bullet Drop Card.
• Chronograph Data.

300 BLK - 220 GR - 898 FPS

| Key          | Value       |
| ------------ | ----------- |
| Caliber      | 300 BLK     |
| Bullet GR    | 220         |
| Bullet Type  | Sierra HPBT |
| Powder Brand | CFE BLK     |
| Powder GR    | 11.7        |
| C.O.A.L      | 2.260       |
| FPS          | 898         |
| Date Tested  | 02/26/2020  |

• Bullet Drop Card.
• Chronograph Data.

300 BLK - 220 GR - 926 FPS

| Key          | Value      |
| ------------ | ---------- |
| Caliber      | 300 BLK    |
| Bullet GR    | 220        |
| Bullet Type  | HPBT       |
| Powder Brand | CFE BLK    |
| Powder GR    | 11.8       |
| C.O.A.L      | 2.231      |
| FPS          | 926        |
| Date Tested  | 02/13/2021 |

• Bullet Drop Card.
• Chronograph Data.

300 BLK - 220 GR - 1030 FPS

| Key          | Value       |
| ------------ | ----------- |
| Caliber      | 300 BLK     |
| Bullet GR    | 220         |
| Bullet Type  | Sierra HPBT |
| Powder Brand | CFE BLK     |
| Powder GR    | 12.0        |
| C.O.A.L      | 2.220       |
| FPS          | 1030        |
| Date Tested  | 02/28/2021  |

• Bullet Drop Card.
• Chronograph Data.

Hope this helps. These are my two favorite loads out of the list:

• 300 BLK - 125 GR - 1834 FPS
• 300 BLK - 220 GR - 1030 FPS

I'm one of those people that doesn't really have a preference on desktop environments. It doesn't really matter if it's Linux, Windows, or a Mac as long as I can get to my applications. If anything, I find myself enjoying desktop environments less and less because they get in the way of applications. Enter i3, a tiling window manager that stays out of the way and maximizes productivity.

Background

Lots of people seem to like their Mac and Windows desktops since they provide a wealth of integrated features. A while back I found myself going the opposite route: I'd run most of my applications full-screen mode so I wouldn't need to interact with the desktop. I didn't want a fancy start menu, a color-coded list of applications, or super-fancy effects as I moved around the environment: I simply wanted to use the application while the desktop stays out of the way.

I then discovered tiling window managers, specifically i3. It simply lays out all of your applications so they utilize maximum screen space. Opening a terminal? It takes up 100% of that monitor. Want to open a second one? Now they both have 50% of the desktop. Two terminals, Signal Desktop, and Thunar? They each take up exactly 25% of the monitor by default. Perfect!

If this is what you're looking for, then you're in the right place.

i3 Setup

Installing the OS

I'm running i3 on Arch Linux. It isn't always the easiest to configure, so I'd highly recommend something like archi to make the process a whole lot faster. If you're looking for something a bit easier to install, try the i3 version of Manjaro. It'll make the setup much, much easier.

These are the basic packages that I install once I'm at the shell. You'll probably get prompted for questions at some point. I just say "yes" to everything or keep hitting return until the install is finished.

pacman -S pacman-contrib base-devel sudo neovim bash-completion git nmap tcpdump mlocate bind-tools tmux zsh wget

Next up is to install paru:

# First switch to a non-root user
su - username
git https://aur.archlinux.org/paru.git
cd paru
makepkg -si

This is totally personal preference here, but I like being able to type the command vi and have it run Neovim.

paru -S neovim-symlinks

Install i3 and Addons

I'll preface this by saying these are my preferred addons and setup. You're free to swap them out as needed. The great thing about i3 is that you can basically pick-and-choose whatever components you'd like, e.g. the web browser, file manager, chat client, etc. It's entirely up to you. I also happen to like the Dracula theme.

That being said:

paru -S google-chrome-beta lightdm-gtk-greeter ttf-meslo-nerd-font-powerlevel10k ranger rofi dunst xfce4-terminal \
lxappearance i3-wm i3lock i3blocks i3status imwheel picom scrot gimp bumblebee-status i3ipc-python \
python-tzlocal redshift dnf xorg-xbacklight network-manager-applet papirus-icon-theme ttf-opensans \
xautolock tmux thunar gvfs libfdk-aac gtkmm3 dracula-gtk-theme

Yes, it's a lot of components, but you'll thank me later :).

Next, copy over the configuration files. There are a bunch of them. Rather than copying and pasting everything here, I'll just include them all as a download in the commands below.

cd ~
wget https://nathanlabadie.com/uploads/i3wm-general-config.tar.gz
tar zvxf i3wm-general-config.tar.gz
cd i3wm-general-config
cp -rvf .config .local ~/
chmod +x .config/scripts/screenlock.sh

A note on that screenlock.sh script: it'll auto-lock the screen after 15 minutes. It's easy enough to change in the file. Once it's locked, you'll notice a blank screen that randomly shows a circle when you mash on the keyboard. That's the password screen :). Quit mashing on the keyboard and just type in your password to unlock.

Now we'll enable LightDM:

sudo systemctl enable lightdm

And finally we'll tweak a few settings so fonts look better:

sudo ln -s /etc/fonts/conf.avail/10-sub-pixel-rgb.conf /etc/fonts/conf.d/
sudo ln -s /etc/fonts/conf.avail/11-lcdfilter-default.conf /etc/fonts/conf.d/

Lastly:

sudo reboot

Setting the GTK Theme

The last configuration tweak will be setting the GTK Theme to Dracula. I'll touch on these key combinations in a second. Hit ALT+d and you'll be presented with rofi, the closest you'll find to a start menu. Type in lxappearance and you'll see a GTK settings menu open. Choose the Dracula theme. I'd also switch the font to Open Sans 11 since it generally looks pretty good.

i3 Basics

This reference card is probably the best you'll find for i3. I have a printed copy on my desk until the key commands become muscle memory. Below are additional commands that were mapped in the configuration above. I'm using ALT as the modifier key in my setup, but you can also switch that to the WIN key if you feel that's more natural.

ALT+b = Google Chrome
ALT+return = xfce4-terminal
ALT+d = rofi, aka your start menu

Another concept that took me a second to wrap my brain around was horizontal versus vertical when it came to stacking. My mind kept going back to how they were separated, e.g. "horizontal" meaning that they're separated with a horizontal line and stacked on top of each other. That is incorrect. It's how the applications are aligned, i.e. "horizontal" means they're side by side.

i3 Demonstration

Let's say you'd like to do the following:

1. Open Chrome and have it take up 50% of the left side.
2. Have a terminal in the upper-right 25%.
3. Have a file explorer in the lower-right 25%.

You'd just do the following key commands:

ALT+b = open a browser.
ALT+return = open a terminal, to the right by default.
ALT+v = the next window should be stacked vertically to above.
ALT+d = open rofi, aka the start menu
Type "Thunar" and hit return.

You could even remove rofi from there by mapping Thunar to a key command in the .config/i3/config file. This is basically the gif that's displayed near the beginning of the article.

Conclusion

There is a ton of customization that can be done with i3 to improve productivity. Just about every action can be mapped to a key command. I'd highly recommend reading through the docs until you get everything tweaked to your liking. Hope this helps!

This is a follow-up to my previous post on the broken RFP process. I'd like to take a step back and cover what should be the easiest part of the RFP: the document format itself. Instead of straight-forward Word or Excel documents with question and answer sections, we've moved to nonsensical formats such as a PDF embedded in an Excel spreadsheet that is part of a Word document that is tied together with macros. Please stop the insanity and stick with the basics.

How Does an RFP Get Answered?

It'd probably help to explain how the RFP gets answered before explaining why multi-pick color-coded dropdown macros are awful. Most companies do not have a dedicated "We Answer RFPs" department. The responsibility largely falls on the local sales team. The sales rep gets a copy of the RFP, the questions get a quick review to make sure the technology is a good fit, and the RFP gets handed to the sales engineer. The sales engineer then acts as a coordinator for the RFP.

What does coordinating an RFP response look like? Well, it's project management. The SE will answer as many questions as possible, send the unanswered questions to the correct teams, collect all of their responses, plug them back into the RFP, review it once again, etc. There are also tools available such as RFPIO that make it a bit easier. You import the RFP, it'll auto-answer what it can, you can assign questions to other people, etc. It makes it less painful, but it's still a manual and time-intensive process in the end.

A Real-World RFP Analogy

Let's say you'd like to find out if a grocery store carries a particular item. Most people would simply call the store and ask. Take it a step further: the person you're speaking with is new to the store and doesn't actually know if they have it in stock. They simply put you on hold, call the department, get the answer, and relay it back to you. Problem solved!

Now, let's say instead of calling the store and asking, you decide to build a multi-tree automated phone application that will call on your behalf. It calls the store clerk, plays a pre-recorded message with the question, and allows them to press "1" for yes, "2" for no, or "3" for N/A. That same clerk presses "2" for no. They're now presented with a new set of choices such as "we never carried this", "we're currently out of stock", "this is a special order item", etc. You also add a voicemail section at the very end where the clerk can add additional details.

Unfortunately though, the menu was missing a few pieces of logic, and it would disconnect the phone call on anything other than "we never carried this". That is how most macro-enabled RFP multi-pick multi-cell dropdowns look to someone who is answering an RFP, complete with the missing logic because something wasn’t copied and pasted correctly. I'd run out of fingers and toes if I listed all the RFPs that involved fighting against macros, or RFPs that included direct links to file shares that only exist on the customer's network.

What's Wrong With My Document Format?

The TL;DR is that the more complex you make the RFP formatting, the more difficult it becomes to either (1) send the question to someone else on the team that can answer it, or (2) correctly upload it into an RFP tool. The obvious answer is "just send the whole document to everyone" and collect the answers, but that goes back to the project management issue that I described in the beginning. There will be lots of mistakes and unnecessary work if you're trying to coordinate 10-15 people answering separate copies of an RFP, especially when you have sections that overlap.

As an example, I just dealt with an issue where the "completed" RFP was exported, but the macro in the RFP only showed it as being 54% complete. Why? Because selecting an answer from a drop-down triggered a macro that caused other questions to appear, which in turn would trigger other questions. It might look fancy to someone showing off their Microsoft Office abilities, but I can promise anyone answering that RFP will wonder what the author was thinking when they put it together.

What Should My RFP Format Look Like?

The underlying theme is keep it simple, aka the KISS principle. You're doing it incorrectly if you need to enable macros or create complex formulas in the RFP. That's also ignoring the fact that every security-minded individual absolutely cringes when they need to turn on macros just to review a document. Your goal is to get answers to your questions, not to build a Turing machine in Excel. As someone that has answered RFPs for close to two decades, the best ones typically follow this format:

• Written in Microsoft Excel.
• The first sheet includes a basic description of the RFP and any additional instructions for completion.
• Each sheet of the XLS references the major sections. This might be "Company Description", "Tech Questions", "Security Assessment", etc.
• Each sheet contains a header row that includes a description of the columns, e.g. "Question Number", "Question", "Answer", and "Additional Information".
• The columns are consistent. Don't have "Column D" be the answer section for some questions, the additional information section for other questions, or potentially a drop-down for even more. That "Column D" should always be for the same type of answer.

...and that's it. It makes copying and pasting simple for everyone involved. Best of all, the majority of RFP assistance tools can import and export that without any issues. I found a perfect example on the State of Vermont Green Mountain Care Board website. I have no idea who wrote that or what the RFP is for, but the person who put that XLS together is my hero. I'd look at that during import and think "this person knows what they are doing".

Conclusion

Sarcasm and bad analogies aside, I truly hope this article causes someone to rethink their approach the next time they're building an RFP. You have questions, we have answers. Don't add unnecessary complexity between the two.

Random RFP writer person at the State of Vermont Green Mountain Care Board website, I salute you.

I recently installed the XFCE edition of Manajaro on VMware Workstation. The install itself was painless, but I ended up needing to make a few tweaks before everything worked as expected on VMware. This guide will walk you through the changes that were made.

List of Tweaks

Install Development Packages

Not all of them are necessary, but without fail I'll eventually need them.

sudo pacman -S pacman-contrib base-devel sudo neovim zsh

Install Paru

The paru command gives you access to the AUR repository that we'll need later.

cd ~
git clone https://aur.archlinux.org/paru.git
cd paru
makepkg -si

Configure the Kernel for VMware

Taken from here.

sudo vi /etc/mkinitcpio.conf

# Change this line:
# MODULES=""
# To this line:
MODULES="vsock vmw_vsock_vmci_transport vmw_balloon vmw_vmci vmwgfx"

# Exit the file and run the following commands:
sudo mkinitcpio -P
sudo grub-mkconfig -o /boot/grub/grub.cfg
sudo reboot

Fix the Scroll Wheel

For some reason the scroll wheel is always wonky. The imwheel command can fix it so the scroll wheel behaves as expected.

paru -S imwheel

You'll also need this to start at boot. Taken from here:

mkdir -p ~/.config/systemd/user/
vi ~/.config/systemd/user/imwheel.service

Add the following to the file above:

[Unit]
Description=IMWheel
Wants=display-manager.service
After=display-manager.service

[Service]
Type=simple
Environment=XAUTHORITY=%h/.Xauthority
ExecStart=/usr/bin/imwheel -d
ExecStop=/usr/bin/pkill imwheel
RemainAfterExit=yes

[Install]
WantedBy=graphical-session.target

Now enable the service:

systemctl --user daemon-reload
systemctl --user enable --now imwheel
journalctl --user --unit imwheel

Conclusion

That should get a few of the VMware oddities out of the way. Have fun!

Alternate Title: Wading Through Massive Amounts of Incorrect and Obsolete Information to Get Docker and Docker-Compose Working With NVIDIA

Summary

If you've stumbled across this article, it's likely because you've been trying to get Docker, docker-compose, and NVIDIA all working together nicely. It's one of those rabbit holes where you think you're this close to finding the correct answer, realize those answers were for the previous version of Docker or docker-compose, modify your search, and then realize you've been reading replies on a Github issue that is 2 years old. Trust me, I've been there and done that already. This article will hopefully provide the answer that you're looking for.

That being said, I'll preface this with all the versions I'm using:

Arch Linux: 12-14-2020
Docker version 19.03.14, build 5eb3275d40
docker-compose version 1.27.4, build unknown
NVIDIA-SMI 455.45.01, Driver Version: 455.45.01, CUDA Version: 11.1
nvidia-container-runtime version 1.0.0-rc9

Please note these instructions are specific to Arch Linux, but similar package names should apply for most Linux distributions.

Installing Related Packages

Paru

You'll need paru since we're using the AUR package repository. Quick instructions:

pacman -S --needed git base-devel
git clone https://aur.archlinux.org/paru.git
cd paru
makepkg -si

Docker

paru -S docker
sudo systemctl enable docker
sudo systemctl start docker

Docker-Compose

paru -S docker-compose

NVIDIA Drivers and Components

paru -S nvidia nvidia-utils nvidia-container-toolkit nvidia-container-runtime

Configuring the System

Loading Kernel Modules

This just ensures the correct modules are loaded between Docker and NVIDIA requirements.

sudo vi /etc/modules-load.d/custom.conf

# Add the following to the file
nvidia
nvidia-modeset
nvidia-drm
nvidia-uvm
aufs
overlay
macvlan

Configuring NVIDIA Runtime for Docker

This adds the option to load NVIDIA drivers in a docker-compose.yml file.

# This should return the file if it exists.
which nvidia-container-runtime

# Edit the config file for Docker.
sudo vi /etc/docker/daemon.json

# Add the following to the file.
{
  "default-runtime": "nvidia",
  "runtimes": {
    "nvidia": {
      "path": "/usr/bin/nvidia-container-runtime",
      "runtimeArgs": []
    }
  }
}

...and finally:

sudo reboot

Conclusion

Testing NVIDIA Drivers on the Host OS

First, you'll want to verify that your Linux distribution can see the video card as expected. You'll be running this from the host OS, not the Docker container. The nvidia-smi command should be able to display information on your card. You do not need to run this as root.

~ ❯ nvidia-smi  

5m 20s nlabadie@nas
Mon Dec 14 23:34:46 2020
+-----------------------------------------------------------------------------+
| NVIDIA-SMI 455.45.01    Driver Version: 455.45.01    CUDA Version: 11.1     |
|-------------------------------+----------------------+----------------------+
| GPU  Name        Persistence-M| Bus-Id        Disp.A | Volatile Uncorr. ECC |
| Fan  Temp  Perf  Pwr:Usage/Cap|         Memory-Usage | GPU-Util  Compute M. |
|                               |                      |               MIG M. |
|===============================+======================+======================|
|   0  Quadro P620         Off  | 00000000:01:00.0 Off |                  N/A |
| 37%   50C    P0    N/A /  N/A |    227MiB /  1998MiB |      0%      Default |
|                               |                      |                  N/A |
+-------------------------------+----------------------+----------------------+

+-----------------------------------------------------------------------------+
| Processes:                                                                  |
|  GPU   GI   CI        PID   Type   Process name                  GPU Memory |
|        ID   ID                                                   Usage      |
|=============================================================================|
|    No running processes found
+-----------------------------------------------------------------------------+

Don't worry about the lack of processes. You just want to make sure the NVIDIA card is recognized, e.g. Quadro P620.

Testing NVIDIA in Docker

Based on the above output, we know that our card is working and detected. Next we'll try the same for Docker via a docker-compose.yml file.

cd ~
vi docker-compose.yml

# Add the following to the file.
version: '2.3'
services:
  nvidia-smi-test:
    runtime: nvidia
    image: nvidia/cuda:9.2-runtime-centos7

Notice that runtime: nvidia under the services: section? That's what you'll need to add for it to be running with the NVIDIA runtime. Next we'll run docker-compose up to bring up that container.

~ ❯ docker-compose up -d     

Creating network "nlabadie_default" with the default driver
Pulling nvidia-smi-test (nvidia/cuda:9.2-runtime-centos7)...
9.2-runtime-centos7: Pulling from nvidia/cuda
75f829a71a1c: Pull complete
3bfd9bee7f23: Pull complete
e264677109d2: Pull complete
04be0f279c7b: Pull complete
c537f616fcbb: Pull complete
0e51dcda29db: Pull complete
Digest: sha256:ee19c7ccab11cc1df37b45417aae9077ac99a8fcee017012218dd57d6c27fe0d
Status: Downloaded newer image for nvidia/cuda:9.2-runtime-centos7
Creating nlabadie_nvidia-smi-test_1 ... done

Finally, we'll make sure that nvidia-smi also works in the Docker container.

~ ❯ docker-compose run nvidia-smi-test                                         
Creating nlabadie_nvidia-smi-test_run ... done
# Notice the next prompt is different? 
# That's because you're like IN THE CONTAINER, man.

[root@16da75e7c31d /]# nvidia-smi

Tue Dec 15 04:46:38 2020
+-----------------------------------------------------------------------------+
| NVIDIA-SMI 455.45.01    Driver Version: 455.45.01    CUDA Version: 11.1     |
|-------------------------------+----------------------+----------------------+
| GPU  Name        Persistence-M| Bus-Id        Disp.A | Volatile Uncorr. ECC |
| Fan  Temp  Perf  Pwr:Usage/Cap|         Memory-Usage | GPU-Util  Compute M. |
|                               |                      |               MIG M. |
|===============================+======================+======================|
|   0  Quadro P620         Off  | 00000000:01:00.0 Off |                  N/A |
| 37%   50C    P0    N/A /  N/A |    227MiB /  1998MiB |      0%      Default |
|                               |                      |                  N/A |
+-------------------------------+----------------------+----------------------+

+-----------------------------------------------------------------------------+
| Processes:                                                                  |
|  GPU   GI   CI        PID   Type   Process name                  GPU Memory |
|        ID   ID                                                   Usage      |
|=============================================================================|
+-----------------------------------------------------------------------------+

Finished

The output shows that NVIDIA drivers are still accessible even within the Docker container. That's it! You can now run NVIDIA-enabled Docker containers via docker-compose and whatever fancy docker-compose.yml files that you have sitting around.

Splunk has a fairly robust API. However, you'll occasionally get into situations where you need the data exported out of Splunk as syslog. This guide walks you through connecting to Splunk with Apache NiFi, pulling data in batches from Splunk via the API, and sending it out as syslog from NiFi. Similar to the Elasticsearch tutorial, the data is near real-time. In this case, we'll have NiFi querying Splunk for 1 minute of data from 5 minutes prior, with the query executing every minute.

Configuration

NiFi Setup

This guide assumes you already have NiFi up and running. If not, I'd previously written a guide on how to get it installed. You can also do a quick and easy install with Docker.

GetSplunk Processor

The first step is to configure the GetSplunk processor. Click on Processor in the top-left corner on the UI and drag it over to the canvas.

You'll then select GetSplunk from the list. Once the processor is on the canvas, double-click on it to access the settings. Keep in mind that we'll be running this every minute asking for 1 minute of data from 5 minutes prior. For example, if it's 12:10, then we'd be asking for the data from 12:04 - 12:05. The next minute we'd be asking for 12:05 - 12:06, then 12:06 - 12:07, etc.

Under the Scheduling tab, put in 1 min for the Run Schedule.

Next click on the Properties tab. You'll want to plug in the following values. Keep in mind that my query is fairly simple: it just asks for everything in the syslog index on Splunk. You'll want to modify this for your environment.

Scheme: https
Hostname: searchhead.splunk.company.internal
Port: 8089
Query: search index="syslog"
Time Field Strategy: Event Time
Time Range Strategy: Provided
Earliest Time: -6m@m
Latest Time: -5m@m
Time Zone: UTC
Application: 
Owner: 
Token: 
Username: yoursplunkusername
Password: yoursplunkpassword
Security Protocol: TLSv1_2
Output Mode: RAW

Click Apply at the bottom once you're finished. By default, this will come out as one giant blob of text. We'll split this up with the next processor.

For reference: if you wanted to pull an hour of logs every hour, e.g. batched logs, then you'd change the Earliest Time to -2h@h and the Latest Time to -1h@h. You'd then set the scheduling above so it runs every hour instead of every minute.

SplitText Processor

Next we'll use the SplitText processor to chop up the previous blob of data into individual events. Drag a SplitText processor onto the canvas and double-click it to access the settings.

First, click on the Settings tab. Check failure and original under Automatically Terminate Relationships. Why? We're going to drop everything except for the split data. We don't need anything else.

Next, click on the Properties tab and enter the following:

Line Split Count: 1

The rest of the values can remain at the defaults. This tells NiFi to split each single line into an individual event. Click Apply when done. We'll now connect the GetSplunk processor to the SplitText processor. Draw a line between the two and click Add at the bottom of the pop-up. You'll end up with this:

Now that we have the individual events, we're going to send them to the PutUDP processor and redirect the events back out of NiFi.

PutUDP Processor

Drag a PutUDP processor to the canvas. Double-click again to open up the processor settings. Under the Settings tab, check the boxes next to Failure and Success under Automatically Terminate Relationships. This is the last processor in the flow, so we'll be dropping everything after it hits this processor.

Next click on the Properties tab. There isn't much to change here.

Hostname: syslogdestination.company.internal
Port: 514

Click Apply when done. Similar to above, you'll then connect the SplitText processor to the PutUDP processor. Select Splits under the For Relationships section when it pops up.

Enabling the Flow

Finally, we'll need to enable everything we just created. Right-click anywhere on the blank canvas and select Start. Assuming there aren't any mistakes, the flow should fire up, start pulling data from Splunk, and streaming it back out in UDP.

Conclusion

The final product should look something like this:

If we watch the output with tcpdump, we should see something like this:

I've used an iPhone for a long, long time. Part of me always cringes when I see the "green text bubble" pop up on my phone. Why? It means it was sent in the clear using a protocol that was invented in the 1980s. I'm also not a fan of routing all of my messages through Facebook, WhatsApp, or any of the infinite number of chat clients where targeted advertising is the main driver.

Enter Signal: the free, open-source, encrypted, and cross-platform messaging client that you should be using.

"An encrypted chat client? That sounds really complicated."

Let me preface this by saying that I can barely add and subtract on a good day. Math is definitely not my strong point and part of the reason that I ended up with a degree in psychology. That being said, Signal is dead-simple to use and completely abstracts the "fully encrypted" component of the client. You don't need to send PGP keys, configure certificates from the OpenSSL command line, or set up any type of encryption gateway. Signal is incredibly easy to use and just works. The only requirement is that you need a phone number: I don't have a problem using my own, but there's nothing stopping you from using a Google Voice number instead.

Features

Overview

There are really two components: the mobile client and the desktop client. Signal is a "mobile first" client, meaning you need to have it installed on your phone before you can set up a desktop client. The desktop client then sync with the phone install. After the phone install, you enable access to your contacts and it'll notify you of other users in your contact list that have Signal installed.  

As mentioned above, one of the best features of Signal is that it's completely cross-platform. Android, iOS, Mac, Linux, and Windows all have the same user experience. This is also a major reason that I ended up going with Signal: my team is a mix of iOS and Android. This way everyone gets the same level of encryption, and I don't need to worry about data being sent in the clear.

Voice and Video Chat

Another outstanding feature of Signal is voice and video chat. Why? It's all encrypted end-to-end and works extremely well. I've got spotty reception in my office which means there's a high likelihood of calls being dropped. On top of that, I've had awful luck with Verizon WiFi calling. Even though I've got a solid Internet connection, the WiFi call eventually gets dropped or someone ends up sounding like a robot. I haven't encountered the issue with Signal: both audio and video calls are crystal clear. In fact, the audio quality is far better than what I'd find with a normal phone call.

Group Chat

Signal recently added decentralized group chat management. Prior to that, it was a bit of a pain point when you had a team chat going: nobody could be kicked from the channel and instead they'd need to voluntarily leave. However, that's been addressed in the recent releases. You can add people, remove people, designate administrators of the channel, etc. It works extremely well and could easily replace something like Teams and WhatsApp for a communication channel.

Summary

It's well worth your time to give Signal a try. It's free, easy to use, and only takes a minute to set up. Most people are surprised when they see how many of their existing contacts already use Signal. It also has the majority of features that you'd find in the more "mainstream" chat clients, minus the advertisements that go along with it. You can also take comfort in knowing that if anyone were to tap your phone line or spy on your instant messages, it'd cause someone to say "damn it, they must be using military-grade industrial encryption firewalls" just like in the movies.

Signal Messenger: Speak Freely

Say “hello” to a different messaging experience. An unexpected focus on privacy, combined with all of the features you expect.

Signal Messenger

I’ve worked in the information security space for over two decades. RFPs are a simple fact of the business: you will have to answer them, and some will be better than others. However, over the last 5-10 years, I’ve watched as RFPs have become progressively more convoluted and irrelevant to the problem that the business is attempting to solve.

Many times you'll notice that RFPs are simply being reused and repurposed, e.g. add a few questions and the firewall RFP becomes the antivirus RFP which then becomes the SIEM RFP. It happens, and we're all guilty of a bit of copy-and-paste. Take that a step further and combine it with onerous procurement processes, perceived and real compliance mandates, and pages of unrelated question that get tacked onto the relevant questions, and eventually the overall purpose and goal of the RFP becomes completely unrecognizable.

Without realizing it, companies are shooting themselves in the foot: the focus becomes completing the Byzantine RFP process instead of identifying the correct technology.

That being said, let’s translate the process to something we’re all likely familiar with: purchasing a vehicle. Imagine that you're in the market for a truck, and leaning towards the Ford F150 or a Dodge Ram. Rather than reading the multitude of reviews or taking the trucks for a test drive, you show up at the dealership with a 400-question RFP that you'd like the dealership to complete within 10 business days. The RFP includes questions such as:

• Describe the accomplishments and backgrounds of all executives at the company.
• How many buttons are included on the dashboard of your vehicle? Describe the exact color and function of each button along with photos of each.
• Please list the water and electric usage for all local and remote employees, along with methods implemented to reduce that consumption.
• Describe the development methods used by the engineering teams assigned to the vehicles. If the answer is not “Agile software development”, please describe the training, certification, and practices used to follow your method of development on the Honda Pilot.
• Describe your reasoning behind adding brakes to the vehicle, specifically when compared to the Nissan Maxima. Include at least 7 examples.
• On a scale of 1-5, on average how many technicians are globally servicing motorcycles on a Tuesday between 3-7 PM Pacific time? What type of motorcycles? What is your SLA on servicing motorcycles?
• Please describe how your vehicle can accelerate from 0 – 178 MPH with exactly 5 occupants in the vehicle while pulling an oblong object attached with a 27-foot chain. Include diagrams and diagnostic output measurements.

Sounds ridiculous, right? Unfortunately this has become the standard.

You walked into the dealership with the desired outcome of purchasing the “better” truck by going through the RFP process. Instead, you’ll end up working with the dealership that told a low-level employee to BS their way through the answers as quickly as possible “to get to the next step”. The dealership already knows that the RFP is just a prelude to the test drive, which itself is likely the step before the actual purchase.

There has to be a better way to meet the goals of the business. Before sending out the next RFP, read through the questions and ask “will these questions help my business identify the best solution, or are they going to get me a bunch of meaningless responses?” If it's the latter, then it might be time to re-evalute the existing process.

"I choose a lazy person to do a hard job. Because a lazy person will find an easy way to do it." --Bill Gates

I'm a fan of finding the minimal amount of effort required to produce the maximum amount of results. Every 6-12 months I try to revisit my note-taking and productivity tools to find areas of improvement. This can range from spreadsheets, to note-taking applications, to the good ol' pen and paper. This article covers my latest iteration of productivity tools and methods, with my latest being Notion in combination with Nebo.

Background

Most of my jobs over the years have required copious amounts of notes. This could range from customer meetings to internal notes to product documentation. It really comes down to two major functions: (1) ingesting the data and (2) organizing the data. If I had to look back, these are the applications and methods that I'd previously used:

• Pen and paper. I still use it quite a bit, but I'll eventually end up with yellow legal pads covered in scrawl. I always tell myself I'll transcribe the notes: instead I end up with cryptic phrases that seem to be written in dead languages. It also doesn't help that my handwriting is horrible and I can't always decipher what I was trying to write.
• Evernote. I used Evernote for years and years. It's still a great tool. However, I started to feel like development had stagnated with OneNote eating into a lot of the business. It also lacked a lot of the flexibility I was looking for: tagging and keywords only go so far. The abundance of integrations was also nice, but the core product started leaving a lot to be desired.
• OneNote. I've tried multiple times to like OneNote. Really, I tried. I've forced myself to use it for months at a time. I've told myself the integration with Outlook was an awesome boost to productivity. The result in the end is always the same: I don't like OneNote. It's too flexible with notes being scattered everywhere, it's not always the most intuitive UI, and it never seems to fit in with the workflow that I'm expecting.
• Trello, Apple Notes, Joplin, SimpleNotes, etc. There's a whole slew that I've tried and quickly moved away from.

Method

Going back to my comment above, I'm looking for ways to improve (1) my data ingest and (2) my data organization.

Ingest

My handwriting is horrible but I like to write out my notes. My memory retention with typed notes isn't the best: I tend to forget everything since I know it's stored away somewhere else. On the other hand, when I write notes out, part of my brain goes back to high school and college where I know I need to remember the information for later use. The downside is that searching through my scrawl hasn't always been easy. I'll get back to that in a minute.

Organization

I'm not a fan of free form note-taking applications. My organized notes are typically a glorified spreadsheet with lots of bullet points and structured data. It's less about form and more about function. The goal is to take all the handwritten data from the ingest phase, convert it to text, and get it organized somewhere.

Tools

All of that being said, I've found two applications that meet almost those exact requirements: Notion and Nebo. There is no direct integration between the two, minus text being exported from Nebo and imported into Notion. That's all I really need between the two of them though.

Apple iPad Air

The hardware part of the equation that ties them together is an iPad Air with an Apple Pencil. The iPad is Gen 4 and the Pencil is Gen 2. I can't speak to the previous generations since I'd never owned one, but it really does an outstanding job with the feeling of "natural" handwriting on the iPad versus a pen and paper. The only minor annoyance was the feeling of writing on glass with the iPad. However, that's easy enough to correct with something a paper-feel screen protector. $20 and it makes a huge difference on the "feel" of writing.

Nebo

There are a few reasons that I ended up with Nebo:

• Simplicity. I don't need my handwriting recognition app to do anything fancy, e.g. heavy-duty note organization, PDF markups, mind maps, etc. I just want to quickly and easily convert my semi-legible scrawl to text.
• Bullet lists. I don't want to use the keyboard when I write. Nebo has a super-easy function to create bullet lists, which I use quite a bit in my notes.
• Easy corrections. Being able to scribble out letters, combine and separate words, have a custom dictionary, etc.
• Reliable handwriting recognition and export. Nebo really excels at this. I'd say it gets close to 99% of my handwriting correct, which is amazing since I can barely read most of what I write.

Write notes in Nebo, convert to text, export to Notion.

Notion

Notion is a tough one to describe. Imagine if a wiki, database, spreadsheet, notebook, and organizational app all got together and had a child. It'd normally be a bunch of half-baked solutions. However, Notion seems to have snagged all the best parts from those and combined them into a highly functional and usable platform. Want to share a page like a wiki? No problem. Create a kanban page? Yep. Create an interactive database of all your active engagements? Sure!

There are a ton of tutorials on effectively using Notion, and it's way beyond the scope of this article. We'll stick with the organize part of ingest and organize. Basically, once the notes are exported to Notion, they're placed on a page that I've reserved as my "exporting dumping ground" for lack of a better term. Think of them as raw notes that will get cleaned up into something usable. The font is also funky when you first export them, but that's easy enough to correct with a format remover like Paste Plain Text or PureText. You'll first end up with this:

I'll then copy and paste this into my "organized" section, adding details as needed.

...with everything going into the Notion "database" of organized data.

Conclusion

I'm sure this will change again in 6 months, but for the moment I'm quite happy with the setup. It's the best of both worlds: I've got my handwritten notes that are slightly committed to memory, along with the searchable and organized version. I'd strongly suggest going through the tutorial videos linked above if you've never used Notion. The learning curve is slightly steeper than something like OneNote or Evernote, but you've got a ton of organizational options once it's up and running.

One of the pain points of Elasticsearch has always been Elasticsearch DSL. The queries never seem to make sense to me, they're always incorrect when I write them, and I've never found a decent "before and after" for UI queries versus the DSL. A co-worker pointed me to a button in Kibana that I'd seen a million times but stopped noticing: Inspect. It'll show you the DSL query from the query that you'd built in the Kibana UI.

Details

Build the Query

The first step is easy: go into the Kibana UI and build the query like you normally would. In this case I'm doing a search over the last 7 days for anything originating from Russia where the destination port is 22. I've also thrown in a few other criteria just to make the DSL output slightly more complex.

geo.country:"Russia" AND dst_port:"22" AND interface:"re1" AND action:"pass"

Hello Vlad.

The Inspect Button

Next click the Inspect button that I somehow never noticed.

On the next screen, click the Request tab. This will show you the DSL that was used in the query. There's even a copy button to make life easier.

The DSL Query

...and here's the resulting DSL output, which is way less intuitive than the query I'd listed out at the beginning of the article.

{
  "version": true,
  "size": 500,
  "sort": [
    {
      "nifi_timestamp": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    }
  ],
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "nifi_timestamp",
        "fixed_interval": "3h",
        "time_zone": "America/Detroit",
        "min_doc_count": 1
      }
    }
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "docvalue_fields": [
    {
      "field": "nifi_timestamp",
      "format": "date_time"
    }
  ],
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "geo.country:\"Russia\" AND dst_port:\"22\" AND interface:\"re1\" AND action:\"pass\"",
            "analyze_wildcard": true,
            "time_zone": "America/Detroit"
          }
        }
      ],
      "filter": [
        {
          "range": {
            "nifi_timestamp": {
              "gte": "2020-10-16T15:48:34.313Z",
              "lte": "2020-10-23T15:48:34.313Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  },
  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {}
    },
    "fragment_size": 2147483647
  }
}

Conclusion

This was one of those "derp" moments when I considered the amount of time I'd spent trying to get DSL queries working. Hopefully this helps someone out.