I have log. I want to find all 4 keywords. It should be AND condition and not OR.
Critical Lab
Lab
Critical Process
Process
If any one of them is not present then fail. If all 4 present then pass.
How to do it in Regex.
"Critical Lab" AND "Critical Process" AND Process
should do it...
I have written REGEX for this. Is this the correct one.
index="cpsprod" sourcetype="mscs:storage:blob:cps-qa-rc-calc" (Critical-Lab AND \"LAB AND Critical-Process AND \"Process)
If you find "Critical Lab" in an event does that also mean "Lab" has also been found?
Can you please share some sample logs(with masking sensitive data) to create regex expression
"Critical-Lab checkRcReady for batchId ==>9a508f01-4e93-4d76-9a9d-fe1cf8bd0550==true :: Output Quality 0.0%"
First of all, you don't need to check all four, since 1st and 3rd also cover for 2nd and 4th.
Secondly, your sample does not tell us where the word(s) 'Critical Process' will occur. I doubt if people will be able to help you without a proper sample.