Bring another 10 or more lines after the search term


(Bernardo Cançado) #1

Hi.

I can´t get the lines below the search term. Entçao when I search "NSSAFG69SCNE014084333" just the line that contains the search term is returned, but I need a few lines below.
An example of search return below.

@timestamp:
September 30th 2016, 10:01:30.022
message:
2016-09-30 10:01:29,533 INFO [BROKER] (ajp-0.0.0.0-8009-255) ##BROKER ENVIO Hora: 10:1:29:533 BROKER: br.gov.prodigio.persistencia.mainframe.MainFrameDAOHelper@2a803efc - NSSAFG69SCNE014084333
@version:
1
path:
/var/log/jboss/broker.log
host:
webpcnetp02
type:
pcnet
_id:
AVd7L3YqGE8IPmeDdYCi
_type:
pcnet
_index:
pcnet-2016.09.30
_score:


(Mark Walkom) #2

Are you suggesting that the original message is multiline?


(Bernardo Cançado) #3

No. In this case is a communication via entire broker, so I sent some information and get a response.
In Kibana I search a shipping passage and need to see the answer.

Example:
2016-10-01 00:00:10,456 INFO [BROKER] (ajp-0.0.0.0-8009-24) ##BROKER SEND Hora: 0:0:10:456 BROKER: br.gov - NSSAFG69SCNE014084333
2016-10-01 00:00:10,456 INFO [BROKER] (ajp-0.0.0.0-8009-24) ##BROKER RETURN CACHE Hora: 0:0:10:456 BROKER: br.gov ##TEMPO:0ms - null

Where: "NSSAFG69SCNE014084333" is my search term.
In the other case is the server.log of jboss where I look for a mistake and need to see the lines below that display the error track.

Maybe i have to search my mistake and when you find something so I make the search by start time to end time.

Kibana was implemented in the company I work for, I did not know the tool and hand tool are not very explanatory.

Thanks.


(Mark Walkom) #4

Ok, KB can't currently do this. There's an open feature request to have it added though.


(system) #5