Add my Errors to the issues ?

[Manoj_g]

In my logs I want all of Errors to map to the issues and if the issue's are not created need to add to another field like other so I can check them and open issues to work on.
Ex: Error's like Badgateway ,connection failed etc each issue is to be mapped to Tkt 123,Tkt456 ..etc and if there are no tkt's opened for the issue the errors should fall into other's.
Dashboard:
Description. Tkt No count
BadGateway. Tkt123 20

My search : index=xyx source=* | search Badgateway OR connectionFaliure OR ..

Any kind of help is appreciated

[gcusello]

Hi Manoj_g,
at first you have to build your search inserting (possibly) all the search terms on the left, so:

index=xyx Badgateway OR connectionFaliure OR ...

insert source=* isn't useful because it isn't a filter (all the events have the souce field)
if you have not maby search terms, you can put them in the main search, if instead you have many errors to search, you can put them in a lookup (called e.g. patterns.csv with one field called pattern) and use them in a search like this

index=xyx [ | inputlookup patterns.csv | rename pattern AS query | fields query ]

in this way the subsearch is the same thing to put all the error strings in OR.
then you have to give the "other" value when there isn't the Tkt, you can do this in this way

| eval Tkt=if(isnull(Tkt)="Other",Tkt)

in this way you can list all the values using the table command

 index=xyx [ | inputlookup patterns.csv | rename pattern AS query | fields query 
| eval Tkt=if(isnull(Tkt)="Other",Tkt)
| table _time tkt

Bye.
Giuseppe

[Manoj_g]

When do I add the Tkt numbers to the Errors as these are not in the Events so I need to add them through search.