I've found a few different answers that approximate, but nothing yet that I can synthesize into a new solution for my environment.
Essentially, I have one log file that keeps a running log of the application's jobs (sourcetype 1). I have a second directory where technical logs of each job are kept and grouped in a subdirectory according to job group (sourcetype 2).
I'm alerting on the first sourcetype and want to include the contents of the second sourcetype in an email based on that alert condition (I can pull the filename from the first sourcetype). Though a failure of the job occurs, it is not certain that there will be any consistency in the messages within the technical logs that I can use to conduct a reliable second search.
Can I include the contents of a file of the second sourcetype in an email alert triggered by a search on the first sourcetype?
EDIT: Adding some detail.
Current search: sourcetype=sourcetype_1 "failure alert" | convert ctime(_time) as time | ...several regex field extractions... | table time,failed_group,count_failed,clients_total,total_status,count_succ,count_dis | sort -time
This gives me a table to monitor the jobs and work with stats. The technical log for any failed job is located at /app/logs/log_type/failed_group/filename. This tree from log_type down is sourcetype_2; filename (unique by job) can be pulled from a different line in sourcetype_1 than the one being matched with failed_group as the connector between sourcetypes.
I want to alert on the matches in the table built from sourcetype_1and include the contents of the relevant technical log file in an email.
Use case is non-technical monitoring people calling on-call technical people. Working on various stats to trigger phone calls from the monitoring folks (they don't take complex instruction well at all) and trying to reduce the need to come on-site in the event of a job failure.
