How to include entire source file in an alert?

[jwinderDDS]

I have an application that generates logs that are not always in a consistent format. Also each time a process in this application executes it creates a whole new log file for that one execution.

Thanks to @woodcock, I can get every event in a source file that triggered an alert. I then merge all of these event into a single field with:

error* OR fail* OR exception OR warn* | dedup source | map search="search source=$source$" | reverse | eval LOG=_raw | fields host, source, LOG | mvcombine LOG | table host, source, LOG

The problem I am having now is, if I initially get results from more than one source, they seem to get merged together in the LOG field. How can I either mvcombine only the events for their respective sources, or show the entire log file?

Thank you!

Jeremy

[woodcock · Accepted solution]

I think you are looking for this:

error* OR fail* OR exception OR warn* | dedup source | map search="search source=$source$" | reverse | stats list(_raw) AS LOGS BY host, source

[jwinderDDS]

That is exactly what I've been trying to produce, with one exception. It truncates one of our longer log files because we are hitting the 1000 byte field size limit. However, this may be "good enough" for our purposes.

Thank you again!

Jeremy

[woodcock]

Please "Accept" the answer.