hi, the data provided was in stats format.
the raw data is like this:
{"container_name":"/beconsumer_KafkaConsumer.1.irz785be5dhsco32lqqtu51bh","source":"stdout","log":"2019-12-03 18:05:00 INFO EventLogger:%_ - Topic: cctiBusinessEvents-Nft01X, Key: 5q9ptD2QRZGkIrv1hPD3Mg, transactionTraceIdentification=ade1c48f-b51f-4b5c-8f17-ae1adcba15f4, paymentProduct=DEPFUND, entityId=f8b15f9d-44e8-48d2-b74b-a6c10c14682a, amount=1, eventCode=customerCreditTransferInitiationCompleted, channel=retail, Offset=226816, currency=DKK, businessEventId=POM-CustomerCreditTransferInitiationV07-2-1782729, instructionReceiptIdentification=PMTDKRG1239297, Partition=1, dateTime=2019-12-03T13:15:04.283Z","container_id":"0172589e4fab1e910305476a8090b66a0d0e5ce6fd8e076e99d51f333d9c45c4"}
{"source":"stdout","log":"2019-12-03 18:05:00 INFO EventLogger:%_ - Topic: cctiBusinessEvents-Nft01X, Key: 5q9ptD2QRZGkIrv1hPD3Mg, entityId=f8b15f9d-44e8-48d2-b74b-a6c10c14682a, eventCode=customerCreditTransferSettled, channel=retail, Offset=226815, businessEventId=POM-CustomerCreditTransferInitiationV07-2-1782726, instructionReceiptIdentification=65052\"}, Partition=1, dateTime=2019-12-03T13:15:04.275Z","container_id":"0172589e4fab1e910305476a8090b66a0d0e5ce6fd8e076e99d51f333d9c45c4","container_name":"/beconsumer_KafkaConsumer.1.irz785be5dhsco32lqqtu51bh"}
{"container_id":"0172589e4fab1e910305476a8090b66a0d0e5ce6fd8e076e99d51f333d9c45c4","container_name":"/beconsumer_KafkaConsumer.1.irz785be5dhsco32lqqtu51bh","source":"stdout","log":"2019-12-03 18:05:00 INFO EventLogger:%_ - Topic: cctiBusinessEvents-Nft01X, Key: 5q9ptD2QRZGkIrv1hPD3Mg, entityId=f8b15f9d-44e8-48d2-b74b-a6c10c14682a, eventCode=customerCreditTransferInitiationProcessed, channel=retail, Offset=226813, businessEventId=POM-CustomerCreditTransferInitiationV07-2-1782725, instructionReceiptIdentification=65052\"}, Partition=1, dateTime=2019-12-03T13:15:03.820Z"}
{"container_name":"/beconsumer_KafkaConsumer.1.irz785be5dhsco32lqqtu51bh","source":"stdout","log":"2019-12-03 18:05:00 INFO EventLogger:%_ - Topic: cctiBusinessEvents-Nft01X, Key: 5q9ptD2QRZGkIrv1hPD3Mg, transactionTraceIdentification=ade1c48f-b51f-4b5c-8f17-ae1adcba15f4, paymentProduct=DEPFUND, entityId=f8b15f9d-44e8-48d2-b74b-a6c10c14682a, amount=1, eventCode=customerCreditTransferInitiationReceived, channel=retail, Offset=226812, currency=DKK, businessEventId=POM-CustomerCreditTransferInitiationV07-2-1782709, instructionReceiptIdentification=PMTDKRG1239297, Partition=1, dateTime=2019-12-03T13:15:03.764Z","container_id":"0172589e4fab1e910305476a8090b66a0d0e5ce6fd8e076e99d51f333d9c45c4"}
and query I use to format it:
search query
| rex "Topic:\s+(?.?),\s+Key:\s+(?.?),"
| rex "entityId=(?\S+?),"
| rex "eventCode=(?\S+?),"
| rex "Partition=(?\S+?)"
| rex "dateTime=(?\S+?)\""
|stats values(topic) as Topic values(entityId) as EntityId list(eventCode) as EventCode list(dateTime) as timestamp by key
... View more
