diff -Nru securityonion-sostat-20120722/debian/changelog securityonion-sostat-20120722/debian/changelog
--- securityonion-sostat-20120722/debian/changelog	2018-03-23 20:06:21.000000000 +0000
+++ securityonion-sostat-20120722/debian/changelog	2018-03-24 11:53:43.000000000 +0000
@@ -1,3 +1,9 @@
+securityonion-sostat (20120722-0ubuntu0securityonion95) trusty; urgency=medium
+
+  * improve formatting 
+
+ -- Doug Burks <doug.burks@gmail.com>  Sat, 24 Mar 2018 07:53:32 -0400
+
 securityonion-sostat (20120722-0ubuntu0securityonion94) trusty; urgency=medium
 
   * iterate over multiple sensors properly 
diff -Nru securityonion-sostat-20120722/debian/patches/improve-formatting securityonion-sostat-20120722/debian/patches/improve-formatting
--- securityonion-sostat-20120722/debian/patches/improve-formatting	1970-01-01 00:00:00.000000000 +0000
+++ securityonion-sostat-20120722/debian/patches/improve-formatting	2018-03-24 11:53:50.000000000 +0000
@@ -0,0 +1,84 @@
+Description: <short summary of the patch>
+ TODO: Put a short summary on the line above and replace this paragraph
+ with a longer explanation of this change. Complete the meta-information
+ with other relevant fields (see below for details). To make it easier, the
+ information below has been extracted from the changelog. Adjust it or drop
+ it.
+ .
+ securityonion-sostat (20120722-0ubuntu0securityonion95) trusty; urgency=medium
+ .
+   * improve formatting
+Author: Doug Burks <doug.burks@gmail.com>
+
+---
+The information above should follow the Patch Tagging Guidelines, please
+checkout http://dep.debian.net/deps/dep3/ to learn about the format. Here
+are templates for supplementary fields that you might want to add:
+
+Origin: <vendor|upstream|other>, <url of original patch>
+Bug: <url in upstream bugtracker>
+Bug-Debian: http://bugs.debian.org/<bugnumber>
+Bug-Ubuntu: https://launchpad.net/bugs/<bugnumber>
+Forwarded: <no|not-needed|url proving that it has been forwarded>
+Reviewed-By: <name and email of someone who approved the patch>
+Last-Update: <YYYY-MM-DD>
+
+--- securityonion-sostat-20120722.orig/bin/sostat
++++ securityonion-sostat-20120722/bin/sostat
+@@ -551,6 +551,7 @@ if [ "$ELASTICSEARCH_ENABLED" = "yes" ];
+ 	if [ "$LOGSTASH_OUTPUT_REDIS" = "yes" ]; then
+ 	echo
+ 	header "Redis"
++		echo
+ 		if pgrep redis-server >/dev/null 2>&1; then
+ 			echo -n "Logs in redis: "
+ 			redis-cli LLEN logstash:redis
+@@ -642,22 +643,24 @@ if [ "$ELASTICSEARCH_ENABLED" = "yes" ];
+                 fi
+         fi
+ 	if [ "$ES_RUNNING" ]; then
+-                echo
+-                header "Cross Cluster Search"
+-		/usr/sbin/so-crossclustercheck | jq "." | grep -B2 ":5" |grep -v "\"seeds\"" | grep -v "^--" | paste -d " " - - | while read i; do
+-                        SEED_NAME=`echo $i | cut -d\" -f2`
+-                        SEED_PAIR=`echo $i | cut -d\" -f4`
+-                        SEED_IP=`echo $i | cut -d\" -f4  | cut -d: -f1`
+-                        SEED_PORT=`echo $i | cut -d\" -f4 | cut -d: -f2`
+-                        if nc -vz $SEED_IP $SEED_PORT > /dev/null 2>&1; then
+-                                STATUS="CONNECTED"
+-                        else
+-                                STATUS="NOT CONNECTED"
+-                        fi
+-                        echo $SEED_NAME - $SEED_PAIR  - $STATUS
+-                        echo
+-                done
+-        fi
++		if [ $(/usr/sbin/so-crossclustercheck | jq "." | grep -B2 ":5" |grep -v "\"seeds\"" | grep -v "^--" | paste -d " " - - | wc -l) -gt 0 ]; then
++	                echo
++        	        header "Cross Cluster Search"
++			/usr/sbin/so-crossclustercheck | jq "." | grep -B2 ":5" |grep -v "\"seeds\"" | grep -v "^--" | paste -d " " - - | while read i; do
++                        	SEED_NAME=`echo $i | cut -d\" -f2`
++	                        SEED_PAIR=`echo $i | cut -d\" -f4`
++        	                SEED_IP=`echo $i | cut -d\" -f4  | cut -d: -f1`
++                	        SEED_PORT=`echo $i | cut -d\" -f4 | cut -d: -f2`
++                        	if nc -vz $SEED_IP $SEED_PORT > /dev/null 2>&1; then
++                                	STATUS="CONNECTED"
++	                        else
++        	                        STATUS="NOT CONNECTED"
++                	        fi
++				echo
++                        	echo $SEED_NAME - $SEED_PAIR  - $STATUS
++        	        done
++	        fi
++	fi
+ fi
+ if [ -f /etc/timezone ] && ! grep "Etc/UTC" /etc/timezone >/dev/null 2>&1; then
+ 	echo
+@@ -672,6 +675,7 @@ if [ -f $FILE ]; then
+ 	source $FILE
+ 	echo
+ 	header "Version Information"
++	echo
+ 	echo $PRETTY_NAME
+ 	if [[ $ALL_PKGS == 1 ]]; then
+ 		echo
diff -Nru securityonion-sostat-20120722/debian/patches/series securityonion-sostat-20120722/debian/patches/series
--- securityonion-sostat-20120722/debian/patches/series	2018-03-23 20:06:25.000000000 +0000
+++ securityonion-sostat-20120722/debian/patches/series	2018-03-24 11:53:48.000000000 +0000
@@ -91,3 +91,4 @@
 sostat:-if-redis-enabled,-show-number-of-events-in-queue
 no-longer-using-crossclustertab
 iterate-over-multiple-sensors-properly
+improve-formatting