How to use pipeline to get results which match the timestamp?

sagarms27 — Tue, 29 Sep 2020 16:27:20 GMT

Hi All,

I have a particular situation in which two logs lines which are related, have only the timestamp in common, I would like to filter them out. Any help would be appreciated. Here are the details:

Log line 1: 2017-06-06 05:42:04,098 902303596 INFO n.n.f.b.i.s.DefaultSignedUrlFactory - resource images/123456-789/123456-789-PV_JPG_HEI_300.JPG can be accessed via https://XXXXXXXX.com/images/XXXXXXXXXX

Log line 2: 2017-06-06 05:42:04,098 902303591 INFO n.n.f.b.c.l.LoggingInterceptor -
abc.def@abcd.com (N/A) - RETAILER
referrer: N/A
request: /images/v1/123456-789-PV?hei=300&fmt=jpg&qlt=70,1&printRes=72
response code: 302

I would need a query which can filter these two results to extract the line in Italics. Its a very busy server and each second 100's of lines of logs would be printed.

Any advice would be highly appreciated.

Regards,
Sagar

Re: How to use pipeline to get results which match the timestamp?

cmerriman — Tue, 24 Oct 2017 12:06:02 GMT

you can use something like:

...|rex field=_raw "(?<timestamp>^[0-9-:\s]+)|\n(?<email>.*\))"|stats values(email) as email by timestamp

assuming that email was what you had wanted extracted. that's what looked to be in italics, to me.

topic How to use pipeline to get results which match the timestamp? in Getting Data In

How to use pipeline to get results which match the timestamp?

Re: How to use pipeline to get results which match the timestamp?