# Getting lines of a log that surround an error message with kibana

**URL:** https://discuss.elastic.co/t/getting-lines-of-a-log-that-surround-an-error-message-with-kibana/289368
**Category:** Kibana
**Tags:** kql-kibana-query-language
**Created:** [November 16, 2021, 8:59pm UTC](https://discuss.elastic.co/t/getting-lines-of-a-log-that-surround-an-error-message-with-kibana/289368 "2021-11-16T20:59:39Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![tnibbe](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@tnibbe](https://discuss.elastic.co/u/tnibbe)
#### Post date: [November 16, 2021, 8:59pm UTC](https://discuss.elastic.co/t/getting-lines-of-a-log-that-surround-an-error-message-with-kibana/289368/1 "2021-11-16T20:59:39Z")

</div>

Hello I am trying to use the ELK stack for error diagnosis with some testing output logs. I have a log structured as follows.

```auto
DateTime MessageType MessageOrigin Message
2021-10-28T00:11:16.385Z INFO fmwk.bll.base.task Received signal KILL

```

The message type defines whether the message is an error, debug, info etc. What I am trying to do is get the 20 or so lines immediately preceding and following when an error message is found. I know I can't get the line number from the original log file, so I have just been using the log.offset which is fine since it doesn't have to be exactly 20 lines. I can filter by messageType and get the offsets of the error messages fairly easily but I don't know how to then get a the group of messages around those offsets.

So basically what I would like is to get the offset of an error message and then check for all messages in a +/- 4000ish range from it to get the context of the error message. Is there a way to chain queries together like that in KQL where the output of one query becomes the input of another?

---

<div class="post-metadata">

### Author: ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)
#### Post date: [December 2, 2021, 7:41pm UTC](https://discuss.elastic.co/t/getting-lines-of-a-log-that-surround-an-error-message-with-kibana/289368/2 "2021-12-02T19:41:15Z")

</div>

> [@tnibbe](#):
>
> What I am trying to do is get the 20 or so lines immediately preceding and following when an error message is found

You can do this with "View Surrounding Fields" in Discover:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/0/901e48926304c187d275e68318f09996da643116.png)

I'm not sure there is a way to do it in a query in Kibana. You would need the set of ranges that include error documents ahead of time. Maybe you could do this in a Python script where it re-indexes the documents adjacent to the errors.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 30, 2021, 7:41pm UTC](https://discuss.elastic.co/t/getting-lines-of-a-log-that-surround-an-error-message-with-kibana/289368/3 "2021-12-30T19:41:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.