Tracking a transaction where the ID changes part way through

[Lgo]

I'm attempting to track a mule transaction where the correlation ID changes part way through the request, I would normally just track based on the correlation ID but this only picks up the first half of the transaction as the ID changes.

Line 263: INFO  2017-08-01 09:39:25,033 [[gateway.v1605-v1.0.9].API_LISTENER_CONFIG.worker.30] org.mule.api.processor.LoggerMessageProcessor: CorrelationID:b8df2f50-7638-11e7-8688-005056bf4ce1, WSSE JWT Issuer v1, Policy...

Then the API picks up the ID of the other system and updates its correlation ID to match (this is the only entry that has both ID's referenced)

Line 1075: INFO  2017-08-01 09:39:27,988 [[gateway.v1605-v1.0.9].API_LISTENER_CONFIG.worker.30] logger.LoggerModule: CorrelationID:b8df2f50-7638-11e7-8688-005056bf4ce1, Message:Setting Correlation Id to OTHER Correlation Id: 896f2b5e-ca4f-400e-8552-9e248b7d7f1b

From then on the original correlation ID isnt referenced again at all.

Is there any way to do this?

[woodcock]

Try this:

index=YouShouldAlwaysUseAnIndex sourcetype=YouShouldAlwaysUseSourcetypeToo | rex max_match=2 "Correlation Id:\s*(?<CorrelationID>[^\s,])" | eventstats values(CorrelationID) AS CorrelationIDs BY CorrelationID | eval CorrelationID=mvindex(CorrelationIDs,0)

After this you will have only 1 CorrelationID across all matching events.

[Lgo]

So I've tested that out, the regex only took the first character of the correlation ID, but I modified it to extract the whole ID, but the new CorrelationID field only exists on the events where the Correlation ID is being changed (the 2nd event in the original post).

I may be mis-understanding how I'm meant to use that to in a transaction command.