In kibana(KQL), In the message field need to combine two conditions

Elastic Stack Kibana
1

Have text message like below in my index

"POST /app/v1/fetch/abcdefgh HTTP/1.1" 404 NR route_not_found - "-" 0 0 0 - “10.0.0.0” “example.xxx.xxx.com" "-" - - 10.10.10.1:80

"POST /app/v1/fetch/abcdefgh HTTP/1.1" 200 route_not_found - "-" 0 0 0 - “10.0.0.0” “example.xxx.xxx.com" "-" - - 10.10.10.1:80

"POST /app/v1/fetch/abcdefgh HTTP/1.1" 200 route_not_found - "-" 0 0 0 - “10.0.0.0” “example.xxx.xxx.com" "-" - - 10.10.10.1:80

How can search from kibana only to get the records for other than 200 means errors and has example keyword

2

Ideally you would be extracting the fields during index time, using an ingest pipeline or similar.
If not, you can try to use a runtime field to pull the events apart and put them in their own fields. But it's likely to be a lot clunkier.

I'm not sure if kql can pull this apart like you want.

3

thank you

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.