How to get multiple events in single row of table?

[archananaveen]

I search logs for these strings: "member left" OR "left cluster" OR "asking member". It gives below output. These events are related to a node/ member and come different sources across hosts. Now I want to display in a table time "asking member leave time" and "notice event time" in a single row. How can I achieve this?

[DEBUG] 2018-01-28 23:07:37.193/40.500 Oracle Coherence GE 12.2.1.0.1  (thread=DistributedCache:DED-OTCM-PartitionedService, member=2): Asking member 1 for primary ownership of PartitionSet{0, 3, 6, 9, 12, 15, 18, 21, 24, 27, 30, 33, 36, 39, 42, 45, 48, 51, 54, 57, 60, 63, 66, 69, 72, 75, 78, 81, 84, 87, 90, 93, 96, 99, 102, 105, 108, 111, 114, 117, 120, 123, 126, 129, 132, 135, 138, 141, 144, 147, 150, 153, 156, 159, 162, 165, 168, 171, 174, 177, 180, 183, 186, 189, 192, 195, 198, 201, 204, 207, 210, 213, 216, 219, 222, 225, 228, 231, 234, 237, 240, 243, 246, 249, 252, 255, 258, 261, 264, 267, 270, 273, 276, 279, 282, 285, 288, 291, 294, 297, 300, 303, 306, 309, 312, 315, 318, 321, 324, 327, 330, 333, 336, 339, 342, 345, 348, 351, 354, 357, 360, 363, 366, 369, 372, 375, 378, 381, 384, 387, 390, 393, 396, 399, 402, 405, 408, 411, 414, 417, 420, 423, 426, 429}


[DEBUG] 2018-01-28 23:07:37.145/40.452 Oracle Coherence GE 12.2.1.0.1  (thread=DistributedCache:DED-OTC-PartitionedService, member=2): Asking member 1 for primary ownership of PartitionSet{0, 3, 6, 9, 12, 15, 18, 21, 24, 27, 30, 33, 36, 39, 42, 45, 48, 51, 54, 57, 60, 63, 66, 69, 72, 75, 78, 81, 84, 87, 90, 93, 96, 99, 102, 105, 108, 111, 114, 117, 120, 123, 126, 129, 132, 135, 138, 141, 144, 147, 150, 153, 156, 159, 162, 165, 168, 171, 174, 177, 180, 183, 186, 189, 192, 195, 198, 201, 204, 207, 210, 213, 216, 219, 222, 225, 228, 231, 234, 237, 240, 243, 246, 249, 252, 255, 258, 261, 264, 267, 270, 273, 276, 279, 282, 285, 288, 291, 294, 297, 300, 303, 306, 309, 312, 315, 318, 321, 324, 327, 330, 333, 336, 339, 342, 345, 348, 351, 354, 357, 360, 363, 366, 369, 372, 375, 378, 381, 384, 387, 390, 393, 396, 399, 402, 405, 408, 411, 414, 417, 420, 423, 426, 429}

[DEBUG] 2018-01-28 23:04:13.308/86254.373 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=5, Timestamp=2018-01-28 23:04:13.308, Address=1.1.1.19:10088, MachineId=64900, Location=machine:xxxxxx4a0209,process:29828,member:MRC-OTC-Partitioned-node4, Role=CoherenceServer) left Cluster with senior member 8

[DEBUG] 2018-01-28 23:04:13.016/86254.081 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=6, Timestamp=2018-01-28 23:04:13.016, Address=1.1.1.17:10090, MachineId=9445, Location=machine:xxxxxx3a0209,process:130402,member:MRC-OTC-Extend-node7, Role=CoherenceServer) left Cluster with senior member 5

[DEBUG] 2018-01-28 23:04:12.957/86254.022 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=7, Timestamp=2018-01-28 23:04:12.957, Address=1.1.1.17:10088, MachineId=9445, Location=machine:xxxxxx3a0209,process:130202,member:MRC-OTC-Partitioned-node3, Role=CoherenceServer) left Cluster with senior member 5

[DEBUG] 2018-01-28 23:04:12.707/86253.772 Oracle Coherence GE 12.2.1.0.1  (thread=Cluster, member=8): Member(Id=3, Timestamp=2018-01-28 23:04:12.707, Address=1.1.1.15:10090, MachineId=19526, Location=machine:xxxxxx2a0209,process:101777,member:MRC-OTC-Extend-node6, Role=CoherenceServer) left Cluster with senior member 5

[archananaveen]

Yes fields are common. However, notice messages has Member(Id=*** in it. I want to construct a table rows if Member(Id= is false. In that row, I want to add the timestamp of events having Member(Id=** and the ID number. Can you please suggest?

_time    Departure Node      Notice Node         Notice node timestamp

xxxxx    member 2                member 8             xxxxxxxx

[somesoni2]

What should be the output based on your sample data? There are multiple events with string "asking member" and "left cluster", so which should be considered for timestamps?

[archananaveen]

Thanks for your comment. I see your point. For now let's leave the duplicates we are seeing for asking member. However, we would need to consider all the events for left cluster. Do you have any suggestion on how to do that?

[somesoni2]

So out of all the events for left cluster, whose timestamp should we take? Again, What should be the output based on your sample data?

[somesoni2]

Do all these events have a common field? If yes, then you can use stats to group multiple events into single row. E.g.

your current search which includes commonField and otherField1, otherField2...
| stats values(otherField1) as otherField1 values(otherField2) as otherField2... by commonField