Hi all,
We have two reverse proxies, one front, one back. They both log http requests and responses to the same index. Each request has a unique-ID that is the same on the front and back. I would like to correlate the front and back requests with the same unique-ID. So the two searches are something like this:
index=rpx proxy=front unique_id=*
index=rpx proxy=back unique_id=*
Log lines would then look something like this (shortened for brevity):
proxy=front, unique_id=123456, time_taken=2ms
proxy=back, unique_id=123456, time_taken=5ms
My goal is to have the delta time of the time_taken field and then display it in for instance a timechart avg. Maybe I should do the one search and correlate from the time_taken field from there?
... View more