Thanks a lot, Giuseppe, for your answer. In the moment I can't to test your query but I think it's right. One doubt: index=anything source=anything Payload OK (route1 OR route1)
| rex field=_raw "\:[0-9]{4} \- (?<IDROUTE>[0-9a-f{8}) \-" It's give me only route1 Payload OK and route2 Payload OK(that are 2 strings from diferrent logs) when o id are equal? Ex: 4545-3a4a5bec route1 Payload OK 4545-3a4a5bec route2 Payload OK That 2 logs above I want to count(route1 and route2 increment) because the id of route1 exists in id of route2 but when: 4545-3a4a5bec route1 Payload OK 2535-6a3f5bab route2 Payload OK The id of route1 dont exists in route2 I want only to count route1 and not increment route2. Thanks again!
... View more