anchor.diff:        with subtest("Kibana is healthy"):
             one.wait_for_unit("kibana.service")
             one.wait_until_succeeds(
  -              "curl --silent --show-error 'http://localhost:5601/api/status' | jq .status.overall.state | grep green"
  +              "curl --silent --show-error --fail-with-body 'http://localhost:5601/api/status'"
  +              + " | jq -es 'if . == [] then null else .[] | .status.overall.state == \"green\" end'"
             )
   
         with subtest("Metricbeat is running"):
             one.wait_for_unit("metricbeat.service")
   
         with subtest("Metricbeat metrics arrive in elasticsearch"):
  -          one.wait_until_succeeds(has_metricbeat() + " | tee /dev/console | grep 'true'")
  +          one.wait_until_succeeds(has_metricbeat())
   
         with subtest("Logstash messages arive in elasticsearch"):
  -          one.wait_until_succeeds(total_hits("flowers") + " | grep -v 0")
  -          one.wait_until_succeeds(total_hits("dragons") + " | grep 0")
  +          one.wait_until_succeeds(expect_hits("flowers"))
  +          one.wait_until_succeeds(expect_no_hits("dragons"))
   
       '' + lib.optionalString (elk ? journalbeat) ''
         with subtest(
  
positive.code:       };
  
      passthru.elkPackages = elk;
      testScript = ''
        import json
  
  
        def total_hits(message):
            dictionary = {"query": {"match": {"message": message}}}
            return (
                "curl --silent --show-error '${esUrl}/_search' "
                + "-H 'Content-Type: application/json' "
                + "-d '{}' ".format(json.dumps(dictionary))
                + "| jq .hits.total"
            )
  
  
        def has_metricbeat():
            dictionary = {"query": {"match": {"event.dataset": {"query": "system.cpu"}}}}
            return (
                "curl --silent --show-error '${esUrl}/_search' "
                + "-H 'Content-Type: application/json' "
                + "-d '{}' ".format(json.dumps(dictionary))
                + "| jq '.hits.total > 0'"
            )
  
  
  
negative.code:           one.wait_for_unit("journalbeat.service")
            one.execute("echo 'Supercalifragilisticexpialidocious' | systemd-cat")
            one.wait_until_succeeds(
                expect_hits("Supercalifragilisticexpialidocious")
            )
      '' + ''
        with subtest("Elasticsearch-curator works"):
  