I've been searching how to join, but every example that I apply seems to be wrong.
I've got referents type of log:
app=my_app_name INFO controller=MyController method=myMethod transaction=999 app=my_app_name INFO controller=MyOtherController transaction_id=999 app=my_app_name INFO controller=CheckoutController params[transaction_id]=999
As you can see, I always have the transaction id in different keys.
So I'm trying to join like this:
index=my_app_name | join "params[transaction_id]" [ search index=my_app_name transaction_id ] | fields controller
But like i said, it seems not to be working, because I've always got some result rows that don't make sense, like:
app=my_app_name INFO controller=CheckoutController order_id=99