If there was some sort of transaction ID, that can help tie things together. In your sample, what does do these fields signify? ABC, abcdefg,1234567890, hijklmnopqrs. Are these values static across all events, or are one or more of them unique for each file request?
In some systems, you'll find something like this (simplifying your example):
[2019:09:10 09:39:15] 12345 !warning! Request to play stream : "http://holiday.mpeg" on [website]
[2019:09:10 09:39:16] 12345 !warning! Show error message : "Streamfail"
[2019:09:10 09:39:20] 12345 success
[2019:09:10 09:39:21] 6789 !warning! Request to play stream : "http://splunk.mpeg" on [website]
[2019:09:10 09:39:30] 6789 success
In this case, transaction ID 12345 has the error message you seek, so the file associated with that transaction ID is what you want displayed, The transaction ID 6789 does not have the error message, so you don't care about this transaction's file.
If this is accurate, then one approach would be to collect all transaction IDs that have Streamfail, and then use those transaction IDs to find the filenames.
... View more
