CloudWatch Logs Insight queries

0

Hello, good evening.

I'm doing a query in CloudWatch Logs Insight to get two date fields, calculate the difference, and display all three fields on the same line.

I extract the two fields (startdate, enddate) with regular expressions. ¿Is it possible to do that operation in CloudWatch?

If you can help me I appreciate a lot.

Thank you so much

salidaConsulta

posta 2 anni fa834 visualizzazioni
2 Risposte
0

How about toMillis(startdate) - toMillis(enddate) to give you the difference?

This may work? You may have to put your regex into the fields line to output the result..

fields startdate,enddate,toMillis(startdate) - toMillis(enddate)
profile picture
ESPERTO
con risposta 2 anni fa
0

Hello,

You can further parse the startdate and enddate to calculate the time difference. I've illustrated this with example log events.

Log event 1: 2023-03-16T23:24:38.973 2023-03-16T23:24:40.586 Log event 2: 2023-03-16T23:23:38.973 2023-03-16T23:24:40.000

Following query will parse the timestamps to 4 segments: date, hours, minutes, seconds

Difference between start and end time is calculated and multiplied to convert the difference to seconds.

PARSE @message "T:: T::" as startdate, s_hour, s_min, s_sec, enddate, e_hour, e_min, e_sec | fields (((e_hour - s_hour) * 3600) + ((e_min - s_min) * 60) + (e_sec - s_sec)) as TimeDifference | display @message, TimeDifference

con risposta 2 anni fa

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande