Filter subset of search results

[ghostrider]

I am trying to filter my search results where only a particular subset of the results should be shown. Example suppose if below is the intermediate search result. 

MESSAGE: Records::0

MESSAGE: Records::1

MESSAGE: Records::0

MESSAGE: Records::4

Final search results should contain only where the records are greater than 0. Is there any query which can help with this?

[gcusello]

Hi @ghostrider,

if you already extracted the Records field, it's easy and you can run:

index=your_index Records>0
| ...

if you didn't extracted the field, you have to extract it, something like this:

index=your_index 
| rex "MESSAGE:\s+Records::(?<Records>\d+)"
| where Records>0
| ...

I could be more sure and detailed if you can share some full sample of your logs.

Ciao.

Giuseppe