CloudWatch Logs Insights

0

How to convert a string value to a number in the CloudWatch Logs Insights query.

My Object

{
            "readonly": false,
            "value": "30",
            "key": "MeterValueSampleInterval"
        }

CloudWatch Logs Insights query

  • not working

    fields @timestamp, @message, @logStream, @log | parse @message/"MeterValueSampleInterval".*?"value\:" "(?<sample_interval>\d+)"/ | filter sample_interval == 30 | sort @timestamp desc | limit 1000

  • Try this

    parse @message/"MeterValueSampleInterval".*?"value" "(?<sample_interval>\d+)"
    

    or

    parse @message/"MeterValueSampleInterval".*?"value\\:" "(?<sample_interval>\d+)"
    
已提問 1 個月前檢視次數 127 次
1 個回答
0

If you're logging a JSON object, CWL should parse it automatically out of the message for you (you'll see key, readonly and value show in the "Discovered Fields" panel on the right). You can just specify the fields in the fields keyword.

The documentation says that the comparison operators work on any datatype so there's no need to convert your string value to an int explicity (the error you're getting is because you're using a to_int() function which doesn't exist.

For example, I injected your sample message in to a log stream and I can find it with this query:

fields @timestamp, @message, value
| filter value = 30

Query demo

profile pictureAWS
專家
James_S
已回答 1 個月前
profile picture
專家
已審閱 1 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南