How to write compound queries on kibana to search multi records of logs

Elastic Stack Kibana
1

Hi team,

I am currently sending my MTAs' /var/log/maillog files to a centralized Elastic Stack Log Analyser. I am using Elastic Stack version 7.X.

I have got a requirement to search set of message ids which look like message-id=<20210411134224.6E07810002DB5@mydomain against their delivery status.

This is happening if I take each message-id individually and get its Queue Id in that MTA and check the delivery status against that Queue Id. But this entire process requires 2 queries for each message id.

Is it possible to check the delivery status of the message ids in a given duration of time with one single compound query or any other means?

The requirement for the compound query is in Kibana Discovery, Visualization and Dashboards

2

Hi
This is not possible in a single query in Kibana, but what you could do is using our transform solution, to create a summarized index containing the delivery status of each message id:

Best,
Matthias

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.