Transaction command with multiple fields

[bcarnot]

I have this start event. I am using the "Phonecall" as the key in the transaction.
1. InteractionEvent on Phonecall-1244025-01a102b0xxxxxxxx, Dn: 1244025@8800, Status: Ringing, StatusChanged: true, Reason: Ringing,
2. Constructing inbound telephony interaction , cli = 1655491xxxx, dnis = 1290xxx, entereddigits = ...

I want to include the inbound caller's phone number (cli) in the table to show duration of call.
The "Phonecall" key is not included in the line of logs where the "cli" is identified.

| transaction Phonecall startswith="Status: Ringing"
endswith="Reason: Done" | table cli Phonecall reason status reason duration eventcount

[micahkemp]

Do you know that the line with Phonecall defined always immediately precedes the line with cli? If so you may be able to use:

| streamstats window=2 current=t last(cli) AS lastcli
| transaction lastcli startswith="Status: Ringing" endswith="Reason: Done"

[bcarnot]

Thank you for your response.
This is the layout of the log every time
Phonecall -xxx Reason: Ringing
cli= caller

The cli will always come after the ringing event.
Thank you for your time, it is really appreciated.

2017-11-21 08:08:44,254 DEBUG InteractionEvent on Phonecall-1244025-01a102b009cxxxxx, Dn: 1244xxx@RB8800, Status: Ringing, StatusChanged: true, Reason: Ringing, Extensions: {Attached Data Changed=}, TEventExtensions: , TEventReasons: null CallId: 1594
2017-11-21 08:08:44,254 DEBUG ***
2017-11-21 08:08:44,254 TRACE Constructing inbound telephony interaction , cli = 1555491xxxx, dnis = 129xxxx, entereddigits = ...
2017-11-21 08:08:44,254 TRACE Setting Telephony System Call ID to null for interaction
2017-11-21 08:08:44,254 TRACE Setting CLI to 1555491xxxx
2017-11-21 08:08:44,254 TRACE Setting DNIS to 129xxxx
2017-11-21 08:08:44,254 TRACE Setting UCID to 15xx
2017-11-21 08:08:44,254 TRACE Setting Telephony System Call ID to Phonecall-1244025-01a102b009cxxxxx

[somesoni2]

If there is no matching field (Phonecall is not available in logs with cli field) how can it identify to which Phonecall event it belongs to? There can be multiple Phone calls in the logs and there may be overlap in the events.

[bcarnot]

the cli event happens 1st then a Phonecall ID is assigned.

2017-11-21 08:08:44,254 TRACE Constructing inbound telephony interaction , cli = 15554910544, dnis = 1290008, entereddigits = ...
2017-11-21 08:08:44,254 TRACE Setting Telephony System Call ID to null for interaction
2017-11-21 08:08:44,254 TRACE Setting CLI to 15554910544
2017-11-21 08:08:44,254 TRACE Setting DNIS to 1290008
2017-11-21 08:08:44,254 TRACE Setting UCID to 1594
2017-11-21 08:08:44,254 TRACE Setting Telephony System Call ID to Phonecall-1244025-01a102b009cc3b53