I am trying to filter my search results where only a particular subset of the results should be shown. Example suppose if below is the intermediate search result.
MESSAGE: Records::0
MESSAGE: Records::1
MESSAGE: Records::0
MESSAGE: Records::4
Final search results should contain only where the records are greater than 0. Is there any query which can help with this?
Hi @ghostrider,
if you already extracted the Records field, it's easy and you can run:
index=your_index Records>0
| ...
if you didn't extracted the field, you have to extract it, something like this:
index=your_index
| rex "MESSAGE:\s+Records::(?<Records>\d+)"
| where Records>0
| ...
I could be more sure and detailed if you can share some full sample of your logs.
Ciao.
Giuseppe