How to get failure and success percentage based on a particular field?

[krishnamurthyj]

Hi,

I have many logs like this 

{"line":{"timestamp":"2022-07-27T20:35:32.756Z","level":"DEBUG","thread":"http-nio-8080-exec-4","mdc":{"clientId":"9AuZjs2vQMCfAYpSB","requestId":"62d-b003-3aff82daddc9","requestUrl":"http://example.com","requestMethod":"POST","apigeeRequestIdHeader":"rrt-0e9fc19850 378837932","requestUri":"/v1/exchanges","userId":"ZWJ5FWLNM"},"logger":"com.eServiceImpl","message":"ChangeSet is not Valid. Error count is : 4. Aggregate error message is : Property of type 'source.acc-1.0.0' is missing required property 'schemaNamespace'.\nProperty of type 'source.acc-1.0.0' is missing required property 'sourceId'.\nProperty of type 'host.acc-1.0.0' is missing required property 'fileUrn'.\nProperty of type 'host.acc-1.0.0' is missing required property 'versionUrn'..Total time for validation is : 0ms"},"source":"stdout","tag":"cd76691","attrs":{"cloudos.portfolio.version":"0.1.2001","com.amazonaask-arn":"arn:aus-west-716:task/COSV2-C-UW2/5e563a4","docker.image":"artifactory.devcloud.net/oud/001","obs.mnkr":"fdxs-abcd22"}}

Success validations are identified by the string "ChangeSet is Valid" in line.message field and failed validations are identified by the string "ChangeSet is not Valid" in line.message as shown above.

Now I want a query to get results of % of failed and passed events by line.mdc.clientId field.

Please Help!

Output:

ClientId     | failed %. | failed events (number).  | pass %  | passed events (number)

A.                 | X%            |. a                                              | Y%          |.  b

.

.

Basic search | line.message="ChangeSet is*"

 The above search is the basic search where I want the grouping of results (as discussed above in example as per clientId) to be happened .

[yuanliu]

Would something like this do?

| rex field=line.message "ChangeSet is (?<verdict>[^\.]+)"
| stats count by verdict line.mdc.clientId
| eventstats sum(count) as total
| eval percent = round(100*count/total, 1)
| fields - count, total

It should give something like

verdict	line.mdc.clientId	percent
Valid	9AuZjs2vQMCfAYpSB	66.7
not Valid	9AuZjs2vQMCfAYpSB	33.3