Given the data:
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S04","TimeStamp":"2019-02-11T15:02:03.8031554+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S01","TimeStamp":"2019-02-11T15:02:09.3830439+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S03","TimeStamp":"2019-02-11T15:04:11.9023453+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S04","TimeStamp":"2019-02-11T15:12:50.5652496+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.UpdatePublication","Host":"S02","TimeStamp":"2019-02-12T06:12:46.7424158+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"ChangeHandlers.WhatsOnOdPublicationChangeHandler.CreatePublication","Host":"S01","TimeStamp":"2019-02-05T02:12:43.9264188+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S01","TimeStamp":"2019-02-05T02:12:44.6623886+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S02","TimeStamp":"2019-02-05T02:12:53.1139799+01:00"}}
{"Properties":{"CorrelationId":"00921908290","PublicationType":"Tv","Source":"CommonServices.StateService.StateChange","Host":"S04","TimeStamp":"2019-02-05T02:13:54.3342244+01:00"}}
And my search:
index="myindex" Properties.PublicationType="Tv"
| transaction "Properties.CorrelationId" keepevicted=t mvlist=t
| search 00921908290
Returns:
2 events (1:first five, 2:last four) , where one event is marked as evicted (most recent).
It seems like the results are grouped pr date (_time) and NOT Properties.CorrelationId.
Am i doing something wrong?
... View more