i have a search which shows me all PHP-Errors in the configured timespan. Now i want so sort this results by matching diffs other results in percent and show results over X% matching results as one.
index=php source="/var/log/docker/php-fpm/error.log" "PHP Fatal error"
Example result 1:
[13-Aug-2019 03:01:29 Europe/Berlin] PHP Fatal error: Uncaught Error: Call to a member function fetch_assoc() on boolean in /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:22 Stack trace: #0 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfiguration.php(10): require_once()
Example result 2:
[12-Aug-2019 17:01:01 Europe/Berlin] PHP Fatal error: Uncaught Error: Call to a member function fetch_assoc() on boolean in /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:12 Stack trace: #0 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/EnvironmentPilot.php(41): include()
Field extractions are very useful but the most php-fpm-errors are very different in their appearance.
Now i want a output like this instead of two results :
PHP Fatal error: Uncaught Error: Call to a member function fetch_assoc() on boolean in /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:22 ....
Thanks in advance for checking my question!
so you extract using a rgeex from PHP Fatal error: Uncaught Error: to end of line or to just before Stack trace: is encountered in the log.
Then you look at how many distinct such extractions you get and calculate percentages based on the counts.
Is this what you are looking for?