How can I compare a field to ephemeral field? I`m trying to get all responses logs from specific requests. Correlation is the same id in request and response logs, but I just can get URI from requests logs.
fields @timestamp, @message
| parse @message "correlation\\":\\"*\\" as correlation
| filter (@message like "\"type\":\"request\"" and uri = "endpoint/xx") or (@message like "\"type\":\"response\"" and @message like correlation)