I am trying to create transactions based on two fields where one changes and one is not always present. For example, I want single transaction of the following events:
event=1 pid=1
event=2 pid=1 qid=2
event=3 pid=2 qid=2
But what I get is 2 transactions, with "...|transaction qid pid":
event=1 pid=1
event=2 pid=1 qid=2
and
event=3 pid=2 qid=2
Is it possible to make transaction do this? The only solution I have been able to think of is to null the pid field for the "event=3" sort of events, but that seems ugly. I have tried the various parameters to transaction, such as connected, unifyends, but they have made no difference.
Just in case my simplified example is inconsistent with reality, the real events are Sendmail submission logs, where the name of the authenticated sender has no queue ID and can only be correlated with the actual messages sent by the PID (and host). (No idea what's going to happen if/when I get looking for multiple messages related to a single authentication event.)
Here's a scrub'd example of my results.
First transaction:
madonna sendmail[10102]: r2RPOYuJ011100: to=<Hildred_Joan@example.com>, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, pri=000404, relay=marget-h0.example.com. [178.115.54.001], dsn=2.0.0, stat=Sent (Ok: queued as 502VQ10L21)
Second transaction:
madonna sendmail[02104]: AUTH=server, relay=host-167-042.dina.ben.edu [031.002.167.042], authid=hpjmm1@ben.edu, mech=PLAIN, bits=0
madonna sendmail[02104]: r2RPOYuJ011100: from=<hpjmm1@ben.edu>, size=10405, class=0, nrcpts=1, msgid=<V2K3020H-7264-3WMX-632E-T4X004IM01A0@ben.edu>, proto=ESMTP, daemon=MSA, relay=host-167-042.dina.ben.edu [031.002.167.042]
FWIW, I'm still on 5.0.3.