How to do a specific Kibana visualization

Elastic Stack Kibana
1

Hello,

I need your help to know if I can do a specific thing.

I have several logs messages has follow:
ABC_FILE_01 -- Received message from abc, assigning ID: 0acf1a1f-9edf-43e1-a929-d711b379604b
ABC_CLEANSING_CM_01 -- client: 0acf1a1f-9edf-43e1-a929-d711b379604b, number: XX received CM quality code for xxxxx@gmail.com is 12345
ABC_ING_01 -- client: 0acf1a1f-9edf-43e1-a929-d711b379604b, idG: 11159999 was created

I want to count all messages beginning by "ABC_ING_01" where id next to "client:" is existing in a message beginning by "ABC_FILE_01".
ID are unique ID.

Thanks for your help.
Antoine

2

What does your mapping look like for the index? How is message broken up into fields?

3

Hello Nathan,

Here is the mapping :
ABC_FILE_01, ABC_CLEANSING_CM_01, ABC_ING_01 are saved into field called "logcode".
Id 0acf1a1f-9edf-43e1-a929-d711b379604b is saved into field called "logid".
11159999 is saved into field called "groupeId"

All others informations are useless for this usecase.

Thanks for your help.

4

Using KQL, the query would look something like logid :* AND logcode : "ABC_ING_01"

5

Hello Nathan,

Thanks for this proposal but with this query I will also count all logid which are not existing in a message beginning by ABC_FILE_01.
Indeed, there are a lot of messages beginning with ABC_ING_01 where logid is not existing in a message beginning by ABC_FILE_01.

I hope to be clear.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.