index=my_index
earliest=-30d
"[ERR] Failed to connect with downstream node"
OR "[ERR] Failed to authenticate downstream node"
OR "[ERR] Downstream node sent invalid response"
I want to get the count of these log messages and plot their count using timechart like
| timechart count(NodeConnectionError), count(AuthenticationError), count(InvalidResponseError) limit=0
Can someone let me know how to determine this also is it possible to aggregate few message count like
| timechart (count(NodeConnectionError) + count(InvalidResponseError) ) as GenericError, count(AuthenticationError), limit=0
Greetings @asubramanian,
Here's a run-anywhere search. Adapt it to your needs.
| makeresults | eval _raw = "[ERR] Failed to connect with downstream node"
| append [ | makeresults | eval _raw = "[ERR] Failed to authenticate downstream node" ]
| append [ | makeresults | eval _raw = "[ERR] Downstream node sent invalid response" ]
| rex "(?<Error>\[ERR\][\w\s]+(node|response))"
| eval ErrorType = case (Error=="[ERR] Failed to connect with downstream node", "NodeConnectionError" ,
Error=="[ERR] Downstream node sent invalid response" , "InvalidResponseError",
Error=="[ERR] Failed to authenticate downstream node", "AuthenticationError" )
| eval ErrorTypeGeneralized = case (ErrorType=="NodeConnectionError" , "GenericError",
ErrorType=="InvalidResponseError", "GenericError",
ErrorType=="AuthenticationError" , "AuthenticationError")
| timechart limit=0 count by ErrorTypeGeneralized
Thanks @jacobevans for the query, how do i specify the index and duration
I added the index and duration just before the reg ex search after the last append
index=my_index
earliest=-1d
| rex "(?<Error>\[ERR\][\w\s]+(node|response))"
and getting an error
Error in 'append' command: The last argument must be a subsearch.