How do I correlate a search with an extracted field?

[rsulliman]

Hello,

I'm looking for something simple, but I can't seem to wrap my head around it.

I have this log entry for example from an Amazon Web Services (AWS) API Gateway:

(b028209b-f1be-11e8-9399-dbd8f601ab06) Method completed with status: 504

Now, I have the transaction ID (b028209b-f1be-11e8-9399-dbd8f601ab06) extracted to a field (APIGW_TID). But I'd like to have a search string that correlates to that transaction ID to show all the entries associated with that ID.

For example, this will find the errors, but how to I use the transaction ID associated with that error to see the entire transaction where a 504 occured?

index=APIGW source=*vmuuyq97j4* AND "Method completed with status: 504"

Thanks!

[richgalloway]

Try a subsearch. The subsearch will find the transaction ID which will be passed to the main search that finds all events with the ID.

index=APIGW source=vmuuyq97j4 [ index=APIGW source=vmuuyq97j4 "Method completed with status: 504" | rex "\((?<transID>[^\)]+\) Method " | fields transID ]