Correlate two results logs

[wellpplava]

Hello!

I have a use case that I need help with.

I need to list the customers who made a purchase, but informing whether there was an error in the journey or not.

I use the following query to find all purchases made:

fetch logs
| filter ((matchesValue(k8s.container.name, "cart") and matchesPhrase(content, "submitOrder - end") and matchesValue(status, "INFO") and isNotNull(customerid)))

and I use the following query to find all errors during the purchase:

fetch logs
| filter ((matchesValue(k8s.container.name, "cart") and matchesValue(status, "ERROR") and matchesPhrase(content, "submitOrder") and isNotNull(customerid)))

How can I add the second information to the first using the customerid? Should I use lookup or enjoy?

[dannemca · Accepted solution]

Try this

fetch logs
| filter ((matchesValue(k8s.container.name, "cart") and matchesPhrase(content, "submitOrder - end") and matchesValue(status, "INFO") and isNotNull(customerid)))
| lookup [fetch logs
| filter ((matchesValue(k8s.container.name, "cart") and matchesValue(status, "ERROR") and matchesPhrase(content, "submitOrder") and isNotNull(customerid)))
], sourceField:customerid, lookupField:customerid

Regards