Archive

Searching multiple log messages and count their occurrence

asubramanian
Explorer
index=my_index
earliest=-30d
"[ERR] Failed to connect with downstream node"
OR "[ERR] Failed to authenticate downstream node"
OR "[ERR] Downstream node sent invalid response"

I want to get the count of these log messages and plot their count using timechart like

| timechart count(NodeConnectionError), count(AuthenticationError), count(InvalidResponseError) limit=0

Can someone let me know how to determine this also is it possible to aggregate few message count like

| timechart (count(NodeConnectionError) + count(InvalidResponseError) ) as GenericError, count(AuthenticationError), limit=0
Tags (1)
0 Karma

jacobpevans
Motivator

Greetings @asubramanian,

Here's a run-anywhere search. Adapt it to your needs.

           | makeresults | eval _raw = "[ERR] Failed to connect with downstream node"
| append [ | makeresults | eval _raw = "[ERR] Failed to authenticate downstream node" ]
| append [ | makeresults | eval _raw = "[ERR] Downstream node sent invalid response"  ]

| rex "(?<Error>\[ERR\][\w\s]+(node|response))"
| eval ErrorType = case (Error=="[ERR] Failed to connect with downstream node", "NodeConnectionError" ,
                         Error=="[ERR] Downstream node sent invalid response" , "InvalidResponseError",
                         Error=="[ERR] Failed to authenticate downstream node", "AuthenticationError" )
| eval ErrorTypeGeneralized = case (ErrorType=="NodeConnectionError" , "GenericError",
                                    ErrorType=="InvalidResponseError", "GenericError",
                                    ErrorType=="AuthenticationError" , "AuthenticationError")
| timechart limit=0 count by ErrorTypeGeneralized
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

asubramanian
Explorer

Thanks @jacobevans for the query, how do i specify the index and duration

I added the index and duration just before the reg ex search after the last append

index=my_index
earliest=-1d
 | rex "(?<Error>\[ERR\][\w\s]+(node|response))"

and getting an error

Error in 'append' command: The last argument must be a subsearch.

0 Karma