How to correlate/compare four different fields from two different events, visualize the events which are not matching, and count values for a different field?

[murthychitturi]

I have a requirement to check for the events that haven't received any response(event-2) for my request(event-1). When a request to aggregator happens, it logs the event as event 1 with fields ctx.msg= "message sent with aggregator id "and aggregator id = "some dynamic number" and when response from aggregator comes it logs as event -2 with parameters or fields ctx.msg="Delivery receipt" and ctx.props.id="value of aggregator id in request event"

Also, I have a requirement to find how many response events happened with specific error codes in the reponse event and count the number of events with different error codes.
event-1- Request

{
"v" : "1.0.1",
"time" : "2016-05-03T15:26:15.969Z",
"level" : "INFO",
"thread" : "syniverse-1",
"loggerName" : "com.sms.gateway.SmppGateway",
"id" : "daf753f3-fb3a-41a7-a217-a8ca1eca4e96",
"ctx" : {
"msg" : "Message sent with aggregator id",
"props" : 
{ "Aggregator Id" : "102420318801461823028868" } 
}
}
event-2- response 
{
"v" : "1.0.1",
"time" : "2016-05-03T15:26:18.610Z",
"level" : "INFO",
"thread" : "ExecutorService-1",
"loggerName" : "com.sms.gateway.service.DeliveryReceiptHandlerService",
"ctx" : {
"msg" : "DeliveryReceipt:",
"props" : 
{ "sub" : 1, "dlvrd" : 1, "err" : "000", "submitDate" : "1605031526", "id" : "102420318801461823028868", "state" : 2, "text" : "ext:8989-**-***", "doneDate" : "1605031526" } 
}
}

ANY HELP IS GREATLY APPRECIATED.

[sundareshr]

For the missing DeliveryReceipt report, you cold try this

.... | eval id=coalesce(id, ctx.props.id) | stats count by msg | where DeliveryReceipt=0 | 

Assuming ctx.props.err is the error field, you could try

index=* msg="DeliveryReceipt" ctx.props.dlvrd=0 | stats count by ctx.props.err