subsearches

[phoenix09]

Spoiler

hello

[phoenix09]

As of now I do not have the log for a valid 500 Error

But for the 500 Error which I want to exclude has two events something like below

Spoiler

Date|LOG_LEVEL:INFO|THREAD_NAME:-|CORRELATION:-|MessID:<dynamicvalue>|MESSAGE:LOGTYPE, SERVER=ip, URL=-, URI=-, METHOD=POST, PARA={"MessID":["<dynamicvalue>"],,"Connection":["close"]}, CODE=500, RTIME=342

Spoiler

Date|LOG_LEVEL:ERROR|THREAD_NAME:-|CORRELATION:-|MessID:<dynamicvalue>|MESSAGE:<some message>

In the above "MessID"  value will be the same

[gcusello]

Hi @phoenix09,

it's difficoult to help you without having something to analyze!

the only way is to identify something unique in the logs to discard or to take.

Ciao.

Giuseppe

[phoenix09]

Spoiler

The http 500 event which is caused due to an exception has the same fields like the valid http 500 error event. So there is no unique word in the event that I can say NOT "this"

[gcusello]

Hi @phoenix09,

could you share some sample of your events? both correct and not correct.

Ciao.

Giuseppe

[phoenix09]

Spoiler

1. I need to create an alert for http 500 failures

2. But I there is this scenario where some http 500 events when triggered, triggers one more event with a message. So I do not want these type of 500 events to be included in the alert

Please help with a query.

[gcusello]

Hi @phoenix09,

did you identified or extracted the message?

if yes, you can simply exclude it from the search: in other words, if the message contains always the word INFO or you extracted the message field, try something like this:

your_search http_response=500 NOT INFO
| ...

or

your_search http_response=500 NOT message=*
| ...

Ciao.

Giuseppe