Create custom Kibana dashboard with custom query

Question

I have 2 log files, 1 for Apache and another for a custom app. To query the logs for errors, the Apache log has log level tag as ERROR while the custom app has a response code tag 500.

I have a dashboard that shows the total errors in Apache log that matches tag = Error and second for total errors that match response code = 500.

My challenge is how to combine both errors as one rather than separating it. I have searched online for documentation on how to define query as global error = total with tag = error in apache log TYPE & total with response = 500 in xxx log type.

Thanks

Answer 1

假设您不想以某种方式关联Apache和应用程序日志，而只是想要与任一条件都匹配的所有事件，即两种类型的错误的总和，则可以正常工作（调整字段名称以使其适合）：

(type:apache AND tags:error) OR (type:custom AND response_code:500)