Count with condition

Elastic Stack Kibana
1

Hi,

i'm new to kibana and I'm struggling with the query. Here is what I want to archieve:

I have log for stransaction, this transaction is splited in 2 different log. One containing information about the transaction final status and one with the information about other internal status.
My goal is to count the number of transaction that failed where the internal status is not fail.

Example of a log imput as my explanation can be vague.

Transaction:

{
"id":"1234",
"final status":"success"
}

global Transaction:

{
"id":"1234",
"internal status":"failed"
}

In this case my count would be 1

Any advice ?

2

Hi @Shawcs,

the number of transaction that failed where the internal status is not fail.

I'm not sure I'm following... are you saying that you want to find IDs where final status: failed but internal status: not failed?

3

Or (re-reading your question) are you simply looking for documents where the internal status field equals failed?

4

Hi @lukeelmers.

My count condition would be the following:

If log entry have the same ID, and we have for this id a final status as success and an internal status as failed we have a count +1

So regarding your answer yes it's your first response

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.