open kibana.
click dashboard.
click saved dashboard.
change time range to 7 days.
click discover.
change time range to 7 days.
click open.
click saved search.
log_level:"ERROR" AND (log_text:"com.microsoft.azure.storage.StorageException" OR log_text:"java.lang.IllegalArgumentException" OR log_text:"java.sql.SQLException" OR log_text:"java.net.SocketException" OR log_text:"org.apache.avro.SchemaParseException" OR log_text:"Cannot allocate memory" OR log_text:"I/O error")
click add button next to fields log_date, log_time, log_level, log_text.
copy putsql id from log_text.
ae51144b-3656-1cba-5d41-823321fc9e86
open nifi ui.
paste id from above in nifi ui search.
get the nifi processor.