# Root cause analysis using Open Distro 7.10.2

**URL:** <https://forum.opensearch.org/t/root-cause-analysis-using-open-distro-7-10-2/10512>\
**Category:** Open Source Elasticsearch and Kibana\
**Tags:** troubleshoot\
**Created:** [August 5, 2022, 2:25pm UTC](https://forum.opensearch.org/t/root-cause-analysis-using-open-distro-7-10-2/10512 "2022-08-05T14:25:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zebish](https://avatars.discourse-cdn.com/v4/letter/z/aca169/32.png) [@zebish](https://forum.opensearch.org/u/zebish)\
**Post date:** [August 5, 2022, 2:25pm UTC](https://forum.opensearch.org/t/root-cause-analysis-using-open-distro-7-10-2/10512/1 "2022-08-05T14:25:42Z")

</div>

Hi, i want to do a root cause analysis for failed request of a test system. I have already store the logs data to open Distro Elasticsearch  
My logs data looks like (this is a small chunk out of 1000 logs giving some meaningful info)

```auto
20220804 14:57:22.640 - INFO - User landed on the campaign page Sleep | 20s ]
20220804 14:57:22.644 - INFO - Campaign created
20220804 14:57:22.647 - INFO - Waiting for the response
20220804 14:57:42.667 - ERROR - TimeoutError: Not all expected api’s appeared

```

above data in Elasticsearch is stored as

> timestamp level message

Now i want to create a GUI which shows me the root cause/anomaly error with a custom message that for example **API ERROR**

How can i achieve this please? any direction, help would be appreciated

---

<div class="post-metadata">

**Author:** ![nateynate](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/nateynate/32/4913_2.png) [@nateynate](https://forum.opensearch.org/u/nateynate)\
**Post date:** [August 8, 2022, 10:02pm UTC](https://forum.opensearch.org/t/root-cause-analysis-using-open-distro-7-10-2/10512/2 "2022-08-08T22:02:18Z")

</div>

Hi @zebish.

I’ll see if I can find someone to help with the problem at hand, but I wanted to drop in and mention this:

[https://opendistro.github.io/for-elasticsearch/blog/2022/08/Open-Distro-is-archived/](https://opendistro.github.io/for-elasticsearch/blog/2022/08/Open-Distro-is-archived/)

There might not be a better time to migrate to OpenSearch.

Nate