Cloudwatch Log Insights Query

0

I want to be able to filter the eventName of S3 by PutObject and CopyObject.

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter detail.eventName in ["PutObject", "CopyObject"]

The above query only returns 1 result which I expect more

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter detail.eventName in ["PutObject"]

Also returns one result

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter detail.eventName="PutObject"

Returns a few result which is correct.

How do I set the filter so that the result returns EventName is either PutObject and CopyObject.

1 Antwort
1
Akzeptierte Antwort

Try this and let me know if it works:

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter (detail.eventName="PutObject" or detail.eventName="CopyObject")
profile picture
EXPERTE
beantwortet vor 8 Monaten
profile picture
EXPERTE
überprüft vor 8 Monaten
  • Yes, it works! What didn't "in" work when applying it to the filter?

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen