In my logs I want all of Errors to map to the issues and if the issue's are not created need to add to another field like other so I can check them and open issues to work on.
Ex: Error's like Badgateway ,connection failed etc each issue is to be mapped to Tkt 123,Tkt456 ..etc and if there are no tkt's opened for the issue the errors should fall into other's.
Description. Tkt No count
BadGateway. Tkt123 20
My search : index=xyx source=* | search Badgateway OR connectionFaliure OR ..
at first you have to build your search inserting (possibly) all the search terms on the left, so:
index=xyx Badgateway OR connectionFaliure OR ...
insert source=* isn't useful because it isn't a filter (all the events have the souce field)
if you have not maby search terms, you can put them in the main search, if instead you have many errors to search, you can put them in a lookup (called e.g. patterns.csv with one field called pattern) and use them in a search like this