How do I group fairly unstructured events by specific words that they contain?

[samsam48]

I have data that doesn't contain many useful fields. I have an initial query that returns a large set of events, and I want to be able to group these events by specific words that they may contain somewhere in their bodies. The pre-chosen words I want to group them by are: "IndexOutOfBoundsException", "NullPointerException", and "Error".

One event may be:

ERROR 08-30 14:17:55.089 [someExecute] Afile(#lineNumber) {personid}: Fake try-catch to throw a IndexOutOfBoundsException 
inside processFunction 
java.lang.StringIndexOutOfBoundsException: String index out of range: -23
    at java.lang.String.substring(String.java:1931)
    at Listener.processMessage(Listener.java:479)
    at Listener.onMessage(GroupPositionsListener.java:450)

Since this event contains the word "IndexOutOfBounds", it should fall into an "index" bucket or group. Is it possible to do this while still retaining the ability to perform other operations on each of the now grouped events? Maybe by counting them or pulling out specific text with a regex for each?

I figure this would be more straight forward if the events were already indexed by a field "error-type" that sorted them by their containing a specific error or the like.

Any suggestions are really appreciated.

[horsefez · Accepted solution]

Hi @samsam48,

regular expressions is the best idea you can have for solving this question. 😃

Try the following in SPL:

yourbasesearch | rex field=_raw max_match=1 "(?<error_type>IndexOutOfBoundsException|NullPointerException|Error)"

You'll get a field that classifies your event into one of the three categories. Tell me if it works, or if you encounter some problems.

[samsam48]

Hi @pyro_wood,

This is great. Thanks!

[horsefez]

You're welcome! 🙂