To detect purchases where no checkout event exists, you will use a similar search as you did in the previous recipe (Alerting on errors during checkout in real time). A transactional search is required to group the entire thread together; once this has been performed, you can look for the threads that do not include the requestType checkout. The search will be as follows:
index=main sourcetype=log4j | transaction threadId maxspan=5m | search paymentReceived="Y" result="success" NOT requestType="checkout" | stats count by threadId, sessionId, orderId, invoice, paymentId, result
You cannot use a per-result alert type for this alert, as it is transactional in nature, grouping events together ...
