Count requests that start, but don't finish

[oompaloompa]

I have an API that logs the start and end of each request. What I'd like to make sure I'm monitoring is the requests that start but, for whatever reason, don't finish. Should never happen, but I'd like to be sure I can identify them just in case.

The start of a request looks like this:

...
line.component="gateway" 
line.message="request received" 
...

The end looks like this:

...
line.component="gateway" 
line.message="request completed" 
...

There is a request-id value logged for each request that traces a given request through the app. What I guess I'm looking for is a left join that counts any null completed values. I've been playing with the "join type=left request-id" syntax, but haven't found the thing that gets me where i need. Any ideas?

[rnowitzki]

Hi @oompaloompa ,

join is pretty hungry, you could better use stats, e.g.:

| line.message="request received" OR line.message="request completed"
| stats dc(line.message) as message_count by request.id
| where message_count=1

Hope it gives you an idea.

BR
Ralph
--
Karma and/or Solution tagging appreciated.