Extract nth line after a search and match if new errors are populating

[vinodarokiya]

Hi ,

I have set of logs from my application instance in which every 4th Line gives the exact error like for example:

Application server error:
        Date 2021/01/11 23:08:11:
        Pid 282606
        Connection from 127.0.0.1:57039 broken.
        Partner exited unexpectedly.

Application server info:

         2021/01/11 23:08:11 pid 263050 completed .000s 0+0us 0+0io 0+0net 9852k 0pf

Application server error:
         Date 2020/12/16 23:33:12:
         Pid 130563
        Connection from 127.0.0.1:39175 broken.
        TCP send failed.
         write: socket: Broken pipe

Application server info:

           2020/12/16 23:33:12 pid 130902 completed .026s 20+6us 0+0io 0+0net 11652k 0pf

I should match for the string " Application server error:" and 4th line from this match gives me exact issue like :Partner exited unexpectedly. and TCP send failed.

First I should match the strings from 4th line and negate few Errors which is prone to occur like negate "TCP send failed." but send alert only if other errors are there.

How do I achieve this,any help is highly appreciated.

Thanks,

[vinodarokiya]

Hi @manjunathmeti,

Thanks for looking into it

Seems like it does not work.

Logs are very big , After I get the line :Application server error: 4th line from this line gives me the exact Error like below Partner exited unexpectedly. So want to get the 4th Line after this match(Application server error:)Please note they are few while spaces before every line after the match.

 Application server error:
     Date 2020/12/16 23:33:25:
     Pid 450892
    Connection from 127.0.0.1:38792 broken.
    Partner exited unexpectedly.

Application server info:
    2020/12/16 23:33:25 pid 139774
Application server info:
   2020/12/16 23:33:25 pid 190474 rcms@rcms_rcmsd_72_246_50_64 127.0.0.1
   4610 2020/12/16 23:33:25 pid 139774 completed .024s 17+6us 0+0io 0+0net 11656k 0pf

[manjunathmeti]

hi @vinodarokiya ,

You can extract using rex command:

| rex ":\d+\sbroken.\s+(?<ERROR>[\w\s]+)" 
| eval ERROR="Application server error: ".ERROR

If you don't want to include events containing the string "TCP send failed" then you can exclude it in your base search only. 

index=<index> sourcetype=<sourcetype> NOT "TCP send failed" 
| rex "\d+\sbroken.\s+(?<ERROR>[\w\s]+)" 
| eval ERROR="Application server error: ".ERROR

If this reply helps you, an upvote/like would be appreciated.