I've got log entries looking like:
from controllers.Logged in play-akka.actor.default-dispatcher-446 SessionId:ztlIsYFI Retrieved Logic3
from services.UserService in play-akka.actor.default-dispatcher-443 SessionId:ztlIsYFI UserId:14223 Fetched user
It's useful to be able to view it with the user id against every entry. It seems I should be able to sessionize these by user with:
* | sessionize "SessionId: * UserId: * " as (sessionid, userid), "SessionId: $sessionid "
but it doesn't return any results. This does work, but the output format isn't great:
* | join (parse "*SessionId:* " as message,sessionid) as all, (parse "SessionId:* UserId: * " as sessionid,userid) as user on all.sessionid=user.sessionid
Any idea why this sessionize wouldn't return any results?
Please sign in to leave a comment.