I have logs in the above format.
The 'key1' "A" changes to "B" ('key2') and this change is documented in the log highlighted in green. After this step, "B" becomes the new value of "A" and the further logs have "B" in the 'key1' field.
I want to have a query where in I can find what value A has changed to("B" in this case) and filter for logs having "A" or "B" in the 'key1' field
The question is, I need to be able to find what B is (this is not known beforehand).
A turns into a value called B , the value of B can be found using one log that highlighted in green.
So my query should be consists of :
Find what A has turned into (B in the example)
Query for logs having key1 as A or B.
I need help with the first point.
Once I get that information I can use B to make a query as you mentioned.
Kibana is currently not able to do dependent queries automatically which would be necessary for a feature like this (fetch data to get "B", then fetch the actual data).
It might be possible using Canvas, but I'm not sure whether this is a good approach to your problem. Can you elaborate why exactly you have to do this? Maybe there is a way to change how your data is stored in Elasticsearch that makes it easier to query your data.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.