How to join log analytics logs from different source

%3CLINGO-SUB%20id%3D%22lingo-sub-2352410%22%20slang%3D%22en-US%22%3EHow%20to%20join%20log%20analytics%20logs%20from%20different%20source%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2352410%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3EWe%20send%20logs%20from%20PCF%20to%20log%20analytics%20and%20we%20have%20alerts%20setup%20here.%20So%20we%20have%20two%20types%20of%20logs%2C%20router%20logs%20and%20diego%20cell%20logs.%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20alerting%20based%20on%20the%20status%20code%20in%20router%20and%20it%20will%20not%20contain%20much%20information%20apart%20from%20what%20api%20is%20called%20and%20the%20status%20code%20and%20other%20router%20related%20information.%20Now%20we%20have%20a%20requirement%2C%20when%20the%20router%20returns%20500%2C%20we%20also%20need%20to%20check%20in%20diego%20cell%20for%20what%20the%20error%20is%20and%20ignore(Dont%20count%20it%20as%20500)%20if%20it%20is%20related%20to%20one%20particular%20error.%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20a%20trace%20id%20to%20match%20the%20log%20between%20router%20and%20diego%20cell.%20Is%20there%20a%20way%20to%20join%20and%20ignore%20that%20error%3F%20Is%20it%20too%20complex%20and%20take%20more%20resources%20to%20run%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Visitor

Hi,

We send logs from PCF to log analytics and we have alerts setup here. So we have two types of logs, router logs and diego cell logs. 

We are alerting based on the status code in router and it will not contain much information apart from what api is called and the status code and other router related information. Now we have a requirement, when the router returns 500, we also need to check in diego cell for what the error is and ignore(Dont count it as 500) if it is related to one particular error. 

We have a trace id to match the log between router and diego cell. Is there a way to join and ignore that error? Is it too complex and take more resources to run? 

0 Replies