We have in our logfile message like this.
Interface: Read orders took 93476 ms, Read 26 items
We want to filter out the milliseconds and check
whether these are greater than 15 minutes or 900000 milliseconds.
For this I wrote a Grokpattern
This one works quite well so far. But unfortunately the > is ignored.
When I use the search with
message: "Read orders took" AND duration:>900000
will not be filtered but all those with values like 94543 will be displayed
I suppose it is because “duration” is kept as datatype unkown.
What am I doing wrong here?