How to alert on conditions across multiple events and include the entire file in the email, not just the line with the error?

[jwinderDDS]

I have an application that generates logs that are not always in a consistent format. Also each time a process in this application executes it creates a whole new log file for that one execution.

I am running into a couple issues:
1) If I setup an alert to send an email anytime "error*" is found in one of these files, we would like the entire file included in the email, not just the line with the error. These alerts need to be filtered based on other information in the log file, such as only alert on "error*" if "something else" is not in the file.
2) I tried solving this by treating the entire file as a single event, but can't seem to make that happen because of the way the application opens, writes, then closed the log files multiple times.

So how can I search for error* in each event, but include the entire source in the alert email, or am I going about this wrong?

Thank you!

Jeremy

[woodcock · Accepted solution]

Try this:

error* | dedup source | map search = "source=$source$"

[jwinderDDS]

Thank you!

This gave me the 'map search=' command I needed.