Hi,
My log file looks like this:
2015-06-12:00:08:54 100.220.144.1 GET /site/path1.aspx 200
2015-06-12:00:08:55 100.220.144.1 GET /site/path2.aspx 200
2015-06-12:00:08:56 100.220.144.1 GET /site/path3.aspx 200
2015-06-12:00:08:56 100.220.144.1 GET /site/path4.aspx 200
2015-06-12:00:08:57 100.220.144.1 GET /site/path1.aspx 200
2015-06-12:00:08:57 100.220.144.1 GET /site/path5.aspx 200
2015-06-12:00:08:58 100.220.144.1 GET /site/path1.aspx 200
2015-06-12:00:08:59 100.220.144.1 GET /site/path2.aspx 200
2015-06-12:00:08:59 100.220.144.1 GET /site/path3.aspx 200
2015-06-12:00:08:59 100.220.144.1 GET /site/path5.aspx 200
2015-06-12:00:08:59 100.220.144.1 GET /site/path4.aspx 200
Now, in the log, the most frequently accessed transaction or URL-path is:
(/site/path1.aspx -->/site/path2.aspx --> /site/path3.aspx)
Is there any way to detect this using Logstash? Please suggest.