How to create a time series from a log file?

[amdosh]

I have a log file with a unique identifier (requestid) for a sequence of events. I want to show a breakup of all events within the requestid. I plan to show that by "marking" the start and stop logs of different events (based on the specific log message) I plan to track and finally create some table like this:

06/14/22 12:35:03.022 requestid=1requestid1 started
06/14/22 12:36:03.022 requestid=1 Event1 started
06/14/22 1237:03.022 requestid=1Event2 started
06/14/22 12:38:03.022 requestid=1 Event2 ended
06/14/22 12:39:03.022 requestid=1 Event1 ended
06/14/22 12:40:03.022 requestid=1requestid1 ended

Event      | Start Time                              | Duration
------------------------------------
Event1| 06/14/22 12:36:03.022.     |  180
Event2| 06/14/22 12:37:03.022.     |  60

The timeseries will be across the duration of the requestid transaction of 5 mins. Could you let me know how this can be achieved? Thanks!

[amdosh · Accepted solution]

I think the best solution for me would be to modify the logs to have something like below and use transaction on the new tracker field.

06/14/22 12:35:03.022 requestid=1 requestid1 started
06/14/22 12:36:03.022 requestid=1 tracker=Event1 started
06/14/22 1237:03.022 requestid=1 tracker=Event2 started
06/14/22 12:38:03.022 requestid=1 tracker=Event2 ended
06/14/22 12:39:03.022 requestid=1 tracker=Event1 ended
06/14/22 12:40:03.022 requestid=1 tracker=requestid1 ended