@Brandon_Kobel, happy to have your response. You are correct, I will be trying to build another visualization, similar to the last one you assisted me with. Yes, I will be searching for a string (keywords) within a field called payload.test_case_exceptions.
What I'm trying to accomplish:
Raise awareness through a counter/metric/visualization when certain keywords show up in the payload.test_case_exceptions field.
- I have a field called "payload.test_case_exceptions".
- Anytime a test case fails, verbose details pertaining to the failure are recorded in the payload.test_case_exceptions field.
Example data recorded in payload.test_case_exceptions field upon failure.
[FAIL] 1 of 3 - Not Exist ID:003 - [server] found within [Your browser sent a request that this server could not understand.]
[FAIL] 2 of 3 - Not Exist ID:003 - [server] found within [Size of a request header field exceeds server limit]
[FAIL] 3 of 3 - Not Exist ID:004 - [Bad Request] found within [400 Bad Request]
Anytime "server" is recorded in the payload.test_case_exceptions field, I want to call attention to that on dashboard, through a new visualization dedicated to errors that require higher priority attention. I have a number of keywords or phrases (like "server" "Bad Request") I'd like to search for in the payload.test_case_exceptions field.
What I've tried to date:
I initially tried to create a scripted field that would perform this type of functionality and record a count of how many times a keyword (server, Bad Request, etc). was found in the payload.test_case_exceptions field but it was simply too much overhead for our elastic configuration and I got all sorts of shard errors.
Where I think I should explore next:
I think I'd like to approach this challenge with Visual Builder again, this time, trying to figure out how it can be used to identify these keywords (server, Bad Request, etc) within payload.test_case_exceptions. This would make it easier to add new keywords of phrases that I want to raise awareness to in the future.
Any help or direction @Brandon_Kobel would be greatly appreciated.