問題文
A team has one event type for the events whose status is 404 and another for the events whose status is 403. They want a single search term that retrieves both. Which approach does the documentation describe?
選択肢
- Combine the two event types with a lookup table definition that maps each name to a shared category.
- Create a third event type whose definition references the two existing ones by name, because event type definitions can be nested.
- Apply a tag to each event type and search for the tags with the plain form that targets field and value pairs, because both forms are interchangeable.
- Apply the same tag to both event types, then search for that tag using the form that targets the tags of event types.