Correlation

What you will do: turn lines from several logs into one object per transaction, measure it, and alert when it is slow, stuck or missing its end.

Correlation in XPLG is TRIX: a Search function that connects events sharing one or more keys into a complex event (CE) and then lets analysis, statistics, anomalies and monitors run on the CE instead of the line. It shipped in build 7.9387. The reference syntax is on Search language reference; this page is how to use it.

A transaction in four lines

* in log.audit
| trix trix.uniqueIds.fields = (user) trix.uniqueSubIds.fields = (pid)
       startRule = (Event Description contains User logged) endRule = (Event Description contains terminated)
       cepNode.maxEventLimit = 50 cep.timeframe.limit = (5 minutes) cep.name = (user) cep.groups = (type) cep.type = (category)
| list cep.id as nodeId, cep.starttime as starttime in date format, cep.endtime as endtime in date format, cep.eventscount as events count, cep.fullstate as state, cep.startEvent as startevent, cep.endEvent as endevent, cep.key as key
| order by nodeId desc

• Key: trix.uniqueIds.fields = (user) joins on any listed column; (user+pid) joins on all of them together. uniqueSubIds can open a CE or join one that already has a uniqueId key, but cannot bridge two uniqueId CEs and should not close one.
• Boundaries: startRule and endRule are filter queries; cep.timeframe.limit, cep.event.timeframe.limitFromStart and cep.maxEventLimit close a CE by time or size. cep.fullstate tells you how it closed: OPEN, CLOSE, TIME CLOSE, VOLUME CLOSE, CLOSE PARTIAL, UNKNOWN. The syntax page spells the limits cep.… and the examples cepNode.…; both forms appear in the wiki.
• Display: cep.name, cep.groups (short values to show or filter on) and cep.type label each CE; enrichments.<name>.first|all = (col) attaches other columns (messages to search for errors in).
• Measures: cep.time (duration), cep.eventscount, cep.starttime, cep.endtime, cep.hosts, cep.logIds — usable with where, avg, min, max, list and display.

* in log.audit | trix trix.uniqueIds.fields = (user) | avg cep.time as Average, min cep.time as Min, max cep.time as Max | display Average in time format, Min in time format, Max in time format
* in log.audit | trix trix.uniqueIds.fields = (user) cep.groups = (Thread) enrichments.message.all = (message) | where cep.message contains exception or error
* in log.secure | trix trix.uniqueIds.fields = (user+pid) endRule = (message contains Connection closed by invalid user OR Disconnecting invalid user OR Disconnected from invalid) cep.name = User | where cep.endEvent = true

The Start and End Event Correlation package

An out-of-the-box App and monitor (wiki, January 2026) that you import and adjust for open and slow transactions. It relies on two conventions worth adopting everywhere:

• the transaction id is parsed with a field type, {text:Entity_ID, ftype=transactionid}, and queried as ftype.transactionid, so the same query works on every service that follows the convention; see Parse;
• the start and end conditions live in an Environment Table named Transaction (Start_Time, End_Time) and are referenced as ${Transaction:Start_Time}, so the logic changes without editing the query.

The query counts start and end events per transaction id, computes the duration with substract and the time since the start with timefromnow, and flags transactions open for more than 60,000 ms or closed after more than 60,000 ms. Tune the threshold to the service's objective, schedule the monitor at least twice the threshold to avoid false positives from ingestion delay, validate in Search on several ids first, and track open transactions above threshold, duration percentiles (p50, p90, p99) and the start-to-end completion ratio over time. Clocks must be synchronized and one canonical timestamp field used.

Other ways to connect events

• innerjoin returns events present in two logs on matching key columns (a custom function installed under conf/ext/scripts/complex/user/, then a restart).
• The Transactions widget lists the transactions a search returns, with a View in Search drill-down; the LogX engines correlate across logs, hosts, applications and transactions with rules, graphs and ML-assisted grouping, and TRIX is also what LogX calls "deep data pattern correlations".
• AppTags group the logs of one application so in app.<name> scopes a correlation to it.

Steps

1. Make sure every source carries the key column with the same meaning (an ftype), and a parsed timestamp.
2. Write the TRIX query with the key only; look at cep.eventscount and cep.fullstate to see whether CEs open and close as expected.
3. Add start and end rules, then the time and size limits.
4. Add the measures you will alert on, save the search, and create a monitor with a risk level; see Monitoring.

Next: Models and credits

Source: XPLG wiki, pages 1718583297, 1720057914, 1715994628, 1735327763, 2736095240, 1602191804, 1594131439, 1594131316, 1594132630, 1594132836 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1718583297).