How to use pipeline to get results which match the timestamp?

[sagarms27]

Hi All,

I have a particular situation in which two logs lines which are related, have only the timestamp in common, I would like to filter them out. Any help would be appreciated. Here are the details:

Log line 1: 2017-06-06 05:42:04,098 902303596 INFO n.n.f.b.i.s.DefaultSignedUrlFactory - resource images/123456-789/123456-789-PV_JPG_HEI_300.JPG can be accessed via https://XXXXXXXX.com/images/XXXXXXXXXX

Log line 2: 2017-06-06 05:42:04,098 902303591 INFO n.n.f.b.c.l.LoggingInterceptor -
abc.def@abcd.com (N/A) - RETAILER
referrer: N/A
request: /images/v1/123456-789-PV?hei=300&fmt=jpg&qlt=70,1&printRes=72
response code: 302

I would need a query which can filter these two results to extract the line in Italics. Its a very busy server and each second 100's of lines of logs would be printed.

Any advice would be highly appreciated.

Regards,
Sagar

[cmerriman]

you can use something like:

...|rex field=_raw "(?<timestamp>^[0-9-:\s]+)|\n(?<email>.*\))"|stats values(email) as email by timestamp

assuming that email was what you had wanted extracted. that's what looked to be in italics, to me.