CloudWatch Logs Insights

0

How to convert a string value to a number in the CloudWatch Logs Insights query.

My Object

{
            "readonly": false,
            "value": "30",
            "key": "MeterValueSampleInterval"
        }

CloudWatch Logs Insights query

  • not working

    fields @timestamp, @message, @logStream, @log | parse @message/"MeterValueSampleInterval".*?"value\:" "(?<sample_interval>\d+)"/ | filter sample_interval == 30 | sort @timestamp desc | limit 1000

  • Try this

    parse @message/"MeterValueSampleInterval".*?"value" "(?<sample_interval>\d+)"
    

    or

    parse @message/"MeterValueSampleInterval".*?"value\\:" "(?<sample_interval>\d+)"
    
preguntada hace 25 días111 visualizaciones
1 Respuesta
0

If you're logging a JSON object, CWL should parse it automatically out of the message for you (you'll see key, readonly and value show in the "Discovered Fields" panel on the right). You can just specify the fields in the fields keyword.

The documentation says that the comparison operators work on any datatype so there's no need to convert your string value to an int explicity (the error you're getting is because you're using a to_int() function which doesn't exist.

For example, I injected your sample message in to a log stream and I can find it with this query:

fields @timestamp, @message, value
| filter value = 30

Query demo

profile pictureAWS
EXPERTO
James_S
respondido hace 25 días
profile picture
EXPERTO
revisado hace 17 días

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas