Identify new log entries during the last hour

(Markus Korn) #1

is there a easy way to identify log messages which are new entries during the last hour?

something similar to significant for last hour, but for a more "generalized" message, so without values in the message like ip addresses, pid ...

(Mark Walkom) #2

You could do this with a query to ES, but it'd probably be difficult.

What's the use case?

(system) #3