Query to find requests that don't have a matching response

(Nikhil Utane) #1


Would like to know if there is a way to write a query that finds out for which all request events, the corresponding response event was missing.

For e.g. In case of below data:

PUT test-index/test/_bulk?refresh


{"msg_type":"request","msg_id":"xyz","message":"Missing response"}

I want to be able to say 1st and 2nd message form a request and response pair (based on msg_id) so all good there. Where as for the 3rd one the response was missing which needs to be highlighted.

One option for me is to generate a missing response event from within logstash but just want to know if there is a query available to achieve the same.


(Mark Harwood) #2

This question looks like another case of "joining related records based on a high cardinality ID"
See How to search relationship between log lines

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.