I recently had to solve the same situation and came up with using the transaction command, so your search would look like this
tag::host="jboss_prod" (source="/usr/share/jbossas/domain/log/servers/sso/saml*" AND loglevel=ERROR) OR
(source="/usr/share/jbossas/domain/log/servers/sso/access*" AND status=500) |
transaction host startswith=loglevel=ERROR endswith=status=500 maxspan=1s
The ANDs are for pure readability ... Not sure if the field name for your HTTP status codes is status but you might get the point.
So with the search command you filter for either loglevel=ERROR in your Jboss Logfile or for any HTTP status=500 in your access_log, then starting a transaction, make sure that the host value is the same for Exception and HTTP 500 and finally maxspan=1s as the ERROR is followed by the HTTP 500 in less than a second.
... View more