How to group two different fields which have same values?

[Span]

Hi,

I have below kind of messages

Received abc message

Error processing abc message

Received def message

Received ghi message

Received ghi message

Error processing ghi message

I am looking for an output like below
Topic recievedcount erroredcount 

abc         1                            1

def           1                           0

ghi            2                            1

I tried below 

index="foo" "Received" OR "Error processing" | rex "Received (?<a>.*) message" | rex "Error processing (?<b>.*) message" | stats count(a) as received, count(b) as errored  by a

But the problem is want my topic on first column which is there in 2 different fields  a and b and cannot group by value. Any help on this is appreciated

[richgalloway · Accepted solution]

You almost had it!  Combine a and b into c for grouping and you should get the desired result.

index="foo" ("Received" OR "Error processing" )
| rex "Received (?<a>.*) message" 
| rex "Error processing (?<b>.*) message" 
| eval c = coalesce(a, b)
| stats count(a) as received, count(b) as errored by c