Correlate two results logs

wellpplava — Thu, 14 Mar 2024 13:36:14 GMT

Hello!

I have a use case that I need help with.

I need to list the customers who made a purchase, but informing whether there was an error in the journey or not.

I use the following query to find all purchases made:

fetch logs
| filter ((matchesValue(k8s.container.name, "cart") and matchesPhrase(content, "submitOrder - end") and matchesValue(status, "INFO") and isNotNull(customerid)))

and I use the following query to find all errors during the purchase:

fetch logs
| filter ((matchesValue(k8s.container.name, "cart") and matchesValue(status, "ERROR") and matchesPhrase(content, "submitOrder") and isNotNull(customerid)))

How can I add the second information to the first using the customerid? Should I use lookup or enjoy?

Re: Correlate two results logs

dannemca — Thu, 14 Mar 2024 18:06:08 GMT

Try this

fetch logs | filter ((matchesValue(k8s.container.name, "cart") and matchesPhrase(content, "submitOrder - end") and matchesValue(status, "INFO") and isNotNull(customerid))) | lookup [fetch logs | filter ((matchesValue(k8s.container.name, "cart") and matchesValue(status, "ERROR") and matchesPhrase(content, "submitOrder") and isNotNull(customerid))) ], sourceField:customerid, lookupField:customerid

Regards

topic Re: Correlate two results logs in DQL

Correlate two results logs

Re: Correlate two results logs