Return adjacent entries until a specific string is found?

[awendler]

This is a rather complex question, at least for me, so please bear with me.

In one of our custom logs, when an error is triggered, there will be > 1 lines returned in the log. The exact number cannot be predicted as it will vary based on how bad the error is, and the error message does not indicate how many lines there will be. When the last relevant line is shown, the next log message will be a predictable string.

What I am trying to create is a search that will look for this error message, and return the error message and every line after it until it reaches that second string.

This is an example of the data:

INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ERROR | task-scheduler-6 | |  |2015-06-23 01:40:21 [AbstractRunnerTask]:70  -
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | INSERT_UPDATE CategoryCategoryRelation;target(OBFUSCATED)
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ,,,value is NULL for mandatory attribute CategoryCategoryRelation.source;0500;
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ,,,value is NULL for mandatory attribute CategoryCategoryRelation.source;0100;
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ,,,value is NULL for mandatory attribute CategoryCategoryRelation.source;0300;
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ,,,value is NULL for mandatory attribute CategoryCategoryRelation.source;020;
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ,,,value is NULL for mandatory attribute CategoryCategoryRelation.source;0205;
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ,,,value is NULL for mandatory attribute CategoryCategoryRelation.source;050;
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ,,,value is NULL for mandatory attribute CategoryCategoryRelation.source;0200;
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ,,,value is NULL for mandatory attribute CategoryCategoryRelation.source;060;
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ,,,value is NULL for mandatory attribute CategoryCategoryRelation.source;030;
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ,,,value is NULL for mandatory attribute CategoryCategoryRelation.source;010;
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 |
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ERROR | task-scheduler-6 | |  |2015-06-23 01:40:21 [AbstractRunnerTask]:71  - end of unresolved lines for file ::: 2_merc_hierarchy-en-17642.csv
INFO   | jvm 2    | main    | 2015/06/23 01:40:21.795 | ERROR | task-scheduler-6 | |  |2015-06-23 01:40:21 [AbstractRunnerTask]:72  - error processing the file ::: 2_merc_hierarchy-en-17642.csv

[AbstractRunnerTask]:70 heralds the beginning of the reported errors. The next lines are the specifics of the error. The final line is "error processing the impex file"

[aljohnson_splun · Accepted solution]

The quick and easy (and slow in a different sense) way would be to use transaction.

... | transaction startswith="ERROR" endswith="error processing the file"

or something of the sort. I'm sure there's a better way though !

[awendler]

That is actually perfect, thank you