Hi all,
I have extracted a field (exit_status) in log file. I want to know if a process exit properly.
I have 3 use cases that can be found in log files, exit_status = normaly, exit_status= -1 or exit_status not exist.
I want to have a visualisation wich count the number of exit_status = normaly and the number of file that not exit normaly ( exit_status = -1 + exit_status do not exist)
I don't know how to create a counter of existing value (-1) plus the number of file where exit_status do not exist.
Hi @clementros,
a little question: have you a process_id that permits to correlate begin process with exit_status?
if yes it's easy to build your search, otherwise you have to find a way to count the executed processes.
In the first case you could have something like this:
index=your_index (process_id=* OR exit_status=*)
| stats values(exit_status) AS exit_status BY process_id
| fillnull value="No exit_status" exit_status
| table process_id exit_status
In the second case you can have only a total of the processes without exit_status.
Ciao.
Giuseppe
Hi @clementros,
a little question: have you a process_id that permits to correlate begin process with exit_status?
if yes it's easy to build your search, otherwise you have to find a way to count the executed processes.
In the first case you could have something like this:
index=your_index (process_id=* OR exit_status=*)
| stats values(exit_status) AS exit_status BY process_id
| fillnull value="No exit_status" exit_status
| table process_id exit_status
In the second case you can have only a total of the processes without exit_status.
Ciao.
Giuseppe
Hi @gcusello
Thank you for your help. The result is good but i do not know how to plot this with a exit_status value count every day
Hi @clementros,
Try something like this:
index=your_index (process_id=* OR exit_status=*)
| stats earliest(_time) AS _time values(exit_status) AS exit_status BY process_id
| fillnull value="No exit_status" exit_status
| timechart span=1d count BY exit_status
Ciao.
Giuseppe
It works than you