Is there a way to search within two anchor messages?

Follow

a a

• September 08, 2020 05:31

Given an example log like:

Process A START
...
Found 4 records
...
Process A END
Process B START
...
Found 0 records
...
Process B END

I want to associate those lines "Found x records" to the enclosing anchor lines "Process y START" and "Process y END" to show a table of
Process | Records
------------------------
A            | 4
B            | 0

Obviously I can't just parse "Found * records" as it by itself lacks the association with the process. It would be trivial if the log is like:
Process A found 4 records
...
Process B found 0 records

But it is not. So is there anyway to join or group details within two anchor messages? Thank you

0

• Official comment

  

  Raghu Murthy

  • September 24, 2020 03:05

  Hi,

   

  Apologize for the long-delayed response.

  We have operators like transactionize that can handle record groupings. Typically, you would need a field like say a transaction id or a session id or process id, that can be link field to connect them as a group of related messages. Along with the transactionize operator, we also have a merge operator that can bundle them together.

   

  Hope that helps

   

  Best Regards

  Raghu

  Comment actions Permalink

Please sign in to leave a comment.