Hi everyone,
I'm currently struggling getting the results I want to receive.
I have a different set of logs, but only need information from two of them. One which logs the method used and another log which contains information about the users.
The objective is, to only extract loginIDs which are relating to events happend in the method logs. The only relation between them, is the sessionID, but the amount of logfiles contains so many entries, that a join is just unpractical.
Example Logfiles:
2019-02-20T09:15:10+01:00 hostname_02 server_name: 2019-02-20 09:15:10 INFO <<<<< object=BackendService_v08, method=getUsername, clID=123456789abcdefg
-
2019-02-20T09:15:15+01:00 hostname_02 server_name: 2019-02-20 09:15:15 INFO (source='session, httpSessionId='123456789abcdefg') RuntimeUserInfo (loginId='dummy' firstName='Test' lastName='User' userId='1234' clientId='99')
I now want to extract the loginId of the relating user (1234) and the method (getUsername). It is possible, that a user executed more than just one method, which then should be grouped by the clientId. However, the only shared information is the clID which is stored in the httpSessionId. Because of approximately 8 million events, a join containing a subsearch is regarding execution time no appropriate solution.
Is there any feasible way to correlate those events and get the userId together with its used methods?
Thanks in advance.
Tom
... View more