1 réponse
- Le plus récent
- Le plus de votes
- La plupart des commentaires
0
If you're logging a JSON object, CWL should parse it automatically out of the message for you (you'll see key
, readonly
and value
show in the "Discovered Fields" panel on the right). You can just specify the fields in the fields
keyword.
The documentation says that the comparison operators work on any datatype so there's no need to convert your string value to an int explicity (the error you're getting is because you're using a to_int()
function which doesn't exist.
For example, I injected your sample message in to a log stream and I can find it with this query:
fields @timestamp, @message, value
| filter value = 30
Contenus pertinents
- demandé il y a 7 mois
- demandé il y a 16 jours
- AWS OFFICIELA mis à jour il y a 2 ans
- AWS OFFICIELA mis à jour il y a 2 ans
- AWS OFFICIELA mis à jour il y a 2 ans
- AWS OFFICIELA mis à jour il y a 2 ans
not working
fields @timestamp, @message, @logStream, @log | parse @message/"MeterValueSampleInterval".*?"value\:" "(?<sample_interval>\d+)"/ | filter sample_interval == 30 | sort @timestamp desc | limit 1000
Try this
or