Thanks @scelikok . Actually I want to see the error logs. And it is a little bit complex. There are different format of logs in different application. What i was trying to do was this: Example: error log for a particular API call is : In Application A: 10.0.9.456 - - 23/Mar/2021:17:29:52 +0000 "POST /abc/test/performuse HTTP/1.1" dest tenant1.myapp.com status 400 refid 1615 msg Some bad request error occured in application A In Application B: 10.0.9.456 - - 23/Mar/2021:17:29:52 +0000 "POST Error occured in Application C status 400 bad request refid 1615 msg Some bad request error occured in application B. Application C: {"app":"myapp","timestamp":"2021-03-23T18:44:21.695Z","eventName":"My-event","component":"My-component","response":{"status":"FAILED","statusCode":"400", "refId":"1615","msg": "something went wrong"} I am using rex to fetch ref id from application A & B. So i am tracing the propagating logs here. So is there any way i can add the logic to fetch refids in the query mentioned. Apart from consolidated panel, I have tried to use subsearch to make different panels also, like : index=*applicationB* [search index=*applicationA* rex <some expression> | fields refid] . It gives me the logs of Application B propagated from A. Now how do i subsearch this refid in application C(as it is in json format) from the data i received from application B? This does not worked for me: index=*applicationC*[search index=*applicationB* [search index=*applicationA* rex <some expression> | fields refid] | rex <some expression> | fields rexid statusCode]
... View more
