I have to send automated reports to a partner with logs and MSISDN that failed due to timeout. Logs are divided by steps, so if I look for telephone number:
I can get them easily, but I don't know if they're failing because the error is showed a step/field after. If I search for the error, it's easy too, but I can't see the phone number associated because it's a step/field before
msg=Exception timeout launched when sending a SMS MT to SMS ParlayX Enabler: The timeout period of 30000ms has been exceeded
The only field in common between those fields is a correlatorID
If I search with it on my sourcetype, I can get all steps, but I get only that, and I need all of them that are failing... Any idea? 🙂
I found it! 🙂
index=pconnectindex sourcetype=parlayx | transaction corr | search lvl=ERROR
basically, the "transaction" command groups multiple events into a single meta-event that represents a single physical event. In my case, sending an SMS have generated several events, with the "corr" field in common. To see the failed ones, I just have to "search" for the level "ERROR".
Piece of cake!
thankyou so much!