I got it working:
Follow these steps:
I used
pattern
in the query to capture the values of DATE and internalUUID:
{logs="java"} | pattern `<DATE> INFO <_> internalUUID: <internalUUID>, <_>`
And then I did these transformations in order:
- Extract the labels to fields.
- Group by the interlanUUID and include all the values of DATE.
- The resulted column is an Array containing the Start Time and End Time. Extract it to fields.
- Organize the fields: Reorder the fields, rename the Time fields and hide the Array field.
- Cast the fields to time to calculate the difference between the End Time and First Time.
- Cast the fields back to string to display the fractions of the seconds.
*The time format used for both Casts is YYYY-MM-DD hh:mm:ss.SSS