LLM Model

| Model                | Total | Active | Context | Vision |

|--------------------|---------|---------|-----------|--------|

| GLM-5.3-Flash | 320B  | 18B    | 1.3M     | Yes    |

| GLM-5.2           | 744B  | 40B    | 1M        | No     |

| Kimi-K2.6         | 1T      | 32B    | 256K     | Yes    |

Key Takeaways

GLM-5.3-Flash: Cheapest to run, longest context. Best for massive document processing and cost-sensitive workloads.

GLM-5.2: Best coding/reasoning in the GLM family. 1M context but no vision. Good for deep technical work.

Kimi-K2.6: Frontier-scale (1T params), strongest agentic capabilities. Best for autonomous agents and multimodal coding tasks.

Recommendation

- Long docs + cheap → GLM-5.3-Flash

- Deep coding → GLM-5.2

- Multimodal agents → Kimi-K2.6

n8n nested loop problem

 nested loop not work in n8n.

Need extra config to make it work.

https://www.youtube.com/watch?v=VNcrPtcqpHo

n8n python container

 https://medium.com/@abhishekaryan2/n8n-task-runners-the-blast-radius-protocol-1b8388364597#:~:text=It%20can%20read%20your%20environment,stripped%2Ddown%2C%20isolated%20container.


how to

keyword mapping on elasticsearch

Issue:
For example there is field category. 
If fitler using event.category , will get result. 
But if using event.category.keyword, will not get result.



 1) Check the mapping

GET logs-*/_mapping

"event": {

"properties": {

"action": {

"type": "keyword",

"ignore_above": 1024

},

"agent_id_status": {

"type": "keyword",

"ignore_above": 1024

},

"category": {

"type": "keyword",

"ignore_above": 1024

},

"code": {

"type": "keyword",

"ignore_above": 1024

},

"created": {

"type": "date"

}

}

Look for category:

• If you see "type": "keyword" → the field is already keyword. Use category (not category.keyword).

• If you see "type": "text" and no "fields": { "keyword": ... } → there is no .keyword subfield.

• If you see a subfield:
  

  "category": {
    "type": "text",
    "fields": {
      "keyword": { "type": "keyword", "ignore_above": 256 }
    }
  }
  
  Be aware of ignore_above: strings longer than that number are not indexed on .keyword, which can yield 0 hits on category.keyword while category (text) still matches.

Escape character in Elasticsearch - 3 Layers

Quick Tips:
- semak dulu bagaimana data disimpan dalam elastic (lihat json, bukan table view)
- kemudian letak escape character utk setiap character yang perlu
Lihat Contoh 3

Contoh 1)
Data Display in Kibana:
  process.command_line : wc -l

Data Display in Json(Actual Data in Elastic)
process.command_line : wc -l
 (sama sebab tiada special character) 

Filter kql
 process.command_line :  * -l*

DSL query:

{ "wildcard": { "process.command_line": { "value": "* -l*" } } }

Contoh 2)
Data Display in Kibana:

process.command_line: "certutil -encode fee449ee0e3965a5246f000e87fde2a065fd89d4.crt temp.cer"

Data Display in Json(Actual Data in Elastic)

"command_line": "certutil -encode cdd4eeae6000ac7f40c3802c171e30148030c072.crt temp.cer "

(sama sebab tiada special character) 

Filter KQL

 process.command_line :  * -encode *

DSL Query
Kql above will translate by kibana to following DSL

{ "wildcard": { "process.command_line": {"value": "* \\-encode *" } } }

Contoh 3)
Data Display in Kibana:
"C:\Users\Asus\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --bypasslauncher $(Arg0)

Data Display in Json(Actual String in Elastic):

"command_line": "\"C:\\Users\\Asus\\AppData\\Local\\Programs\\Opera GX\\autoupdate\\opera_autoupdate.exe\" --scheduledtask --bypasslauncher $(Arg0)"

 (tak sama sebab ada special character) 

Filter KQL

process.command_line: *\\Users\\* 

DSL Query

{ "wildcard": { "process.command_line": { "value": "*\\\\Users\\\\*" } } }

Elastic Alert Aliases

 GET /_cat/aliases?v

ada byk index yg alias nama lain.

Aliases                                     Index
.alerts-security.alerts-default     .internal.alerts-security.alerts-default-000024
.siem-signals-default                 .internal.alerts-security.alerts-default-000024

Permission, kena bagi secara berasingan. 

Di page 'Alerts', kena bagi permission index:

        .alerts-security.alerts-default

Di 'Discover', allow

        .siem-signales-default

Ahli Sunnah Wal Jamaah

who is ahlu Sunnah Wal Jamaah

ref: https://www.youtube.com/watch?v=oSYYd4RjKE8