What is best practice to get information that may be strewn over multiple lines of a log file.
Desired result: visualization of how many times 'person' bought a 'coffee' over a period of time.
I have to parse through a log which tracks events, but there is a separate log line for the person who event pertains to. The threadid for the whole transaction is the same to link them, but lines are separated.
example log lines.
timestamp threadid "Person logged in"
timestamp threadid "Coffee purchased"
the threadids are the same, but timestamps are different. looking for a way to link these events in a manner that can be used in a visualization.
thank you