We have log entries in format like this:
LogLevel=info username=some1 eventID=update
So in case of error the LogLevel will be LogLevel=error
LogLevel can also be debug
What I need to do is to find all users that had eventID=update but always had LogLevel=error and present them in table format
Username | count
If I simply search
eventID=update LogLevel=error then I will get all matching entries for users with LogLevel=error but some of these users probably also had entries with LogLevel=info (or debug)
How do I find users that had only LogLevel=error with this eventID?
... View more