How to do a specific Kibana visualization


I need your help to know if I can do a specific thing.

I have several logs messages has follow:
ABC_FILE_01 -- Received message from abc, assigning ID: 0acf1a1f-9edf-43e1-a929-d711b379604b
ABC_CLEANSING_CM_01 -- client: 0acf1a1f-9edf-43e1-a929-d711b379604b, number: XX received CM quality code for is 12345
ABC_ING_01 -- client: 0acf1a1f-9edf-43e1-a929-d711b379604b, idG: 11159999 was created

I want to count all messages beginning by "ABC_ING_01" where id next to "client:" is existing in a message beginning by "ABC_FILE_01".
ID are unique ID.

Thanks for your help.

What does your mapping look like for the index? How is message broken up into fields?

Hello Nathan,

Here is the mapping :
ABC_FILE_01, ABC_CLEANSING_CM_01, ABC_ING_01 are saved into field called "logcode".
Id 0acf1a1f-9edf-43e1-a929-d711b379604b is saved into field called "logid".
11159999 is saved into field called "groupeId"

All others informations are useless for this usecase.

Thanks for your help.

Using KQL, the query would look something like logid :* AND logcode : "ABC_ING_01"

Hello Nathan,

Thanks for this proposal but with this query I will also count all logid which are not existing in a message beginning by ABC_FILE_01.
Indeed, there are a lot of messages beginning with ABC_ING_01 where logid is not existing in a message beginning by ABC_FILE_01.

I hope to be clear.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.