Our application's log-entries are in JSON and I need to search for certain strings found in the field called message.
I have no problem finding them with a regular search:
... AND (message="Application is closing." OR message="successfully started")
However, when I try to define a transaction with the seemingly same search criteria:
| transaction source startsWith="message=\"Application is closing.\"" endsWith="message=\"successfully started\""
I get zero results... Am I escaping the quotes incorrectly or making some other syntax error?
Here is the sample:
message: Managed service successfully started
message: Application is closing. Running commands will end with partial results.