topic Re: Combining logs and triggering alert in Alerting

Combining logs and triggering alert

vineela — Fri, 07 May 2021 07:55:09 GMT

I need to combine logs from multiple events based on unique field and trigger an alert if order is missing in events generation.
Example :
If there is any transaction then events should generate in like wise order depending on reference number.
First event should be initiation followed by debit followed by verification followed by creditor verification and then money debit and credit into accounts.
Based on this i need to combine all the results in one order and trigger an alert if any event missed in this order.
Can anyone please help me on this????

Re: Combining logs and triggering alert

richgalloway — Fri, 07 May 2021 12:41:43 GMT

That's not a lot to work with, but you may be successful counting transactions for each reference number and generating an alert if the number of transactions falls below an expected amount.

... | stats values(transaction) as transactions by referenceNumber | where mvcount(transactions) < 5 | table referenceNumber transactions

Re: Combining logs and triggering alert

vineela — Fri, 07 May 2021 13:25:49 GMT

I agree with you...but also i need to check which log is missing i mean in which step its failing to move further, That thing helps me much better in this case for easy solvation.
Thanks for your solution .
Can anyone help me on the same.

Re: Combining logs and triggering alert

richgalloway — Fri, 07 May 2021 15:01:19 GMT

This should help find the missing transactions. Add it to the end of the previous query.

| eval missing="" | foreach "initiation" "debit" "verification" "creditor verification" "money debit and credit" [eval missing=missing . if(isnull(mvfind(transactions,"<<FIELD>>")),"<<FIELD>> ","")] | table transactions missing

Re: Combining logs and triggering alert

vineela — Tue, 11 May 2021 07:47:53 GMT

That helps me a lot. Thanks