Identify new log entries during the last hour


(Markus Korn) #1

Hi,
is there a easy way to identify log messages which are new entries during the last hour?

something similar to significant for last hour, but for a more "generalized" message, so without values in the message like ip addresses, pid ...


(Mark Walkom) #2

You could do this with a query to ES, but it'd probably be difficult.

What's the use case?


(system) #3