Comparing fields of different events in the same log file

[gaishi]

Hello all,

I'd like to compare events in the same log files, amusing the format of the events are the same. For example:

event1: ccc, ddd

event2: bbb, ccc

event3: aaa, bbb

As you can see there's a pattern, the 2nd part (bbb) in event3 is always the same as the 1st part in event2, and the 2nd part in event 2 (ccc) is always the same as the 1st part in event 1.

My question is how do I check if all the events in the same log file match this pattern. Thank you in advance!

Sincerely,

Gai

[ITWhisperer]

Assuming you have fields called field1 and field2, and your events are already in the order you want to compare.

| streamstats window=2 current=f values(field1) as previous_field1
| eval match2withprevious1=if(field2=previous_field1,"match","not match")

[gcusello]

Hi @gaishi,

if you want to check the presence of a predefined pattern (e.g. "bbb"), you could run something like this:

index=your_index
| eval check=if(searchmatch("bbb"),"yes","not")
| table _time _raw check

If instead you want to check the patterns in your logs, there's a tab in the search dashboard.

Ciao.

Giuseppe