create-export-task | Filter CloudWatch logs using JMESpath

1

My objective is to create a mechanism for exporting CloudWatch logs to S3 on a case-by-case basis. Given my logs appear in the following format:

{ "level": "error", "message": "Oops", "errorCode": "MY_ERROR_CODE_1" }
{ "level": "info", "message": "All good" }
{ "level": "info", "message": "Something else" }

I'd like the export to only include the error logs. Using create-export-task, is it possible to use the query param to filter the response data given the above log structure?

I'm not sure whether the log structure is incorrect for this use or if I have misunderstood the purpose of the query param.

My JMESPath attempts so far have been unsuccessful. Some attempts include:

aws logs create-export-task \
    --log-group-name myGroup \
    --log-stream-name-prefix myGroup-test \
    --from 1664537580000 \
    --to 1664537640000 \
    --destination myGroup-archive-ab1 \
    --destination-prefix test \
    --query '{Message: message, Error: errorCode}'

and same command, but with the following query --query '{Message: .message, Error: .errorCode}' which produces the following error:

Bad value for --query {Message: .message, Error: .errorCode}: invalid token: Parse error at column 10, token "." (DOT), for expression: "{Message: .message, Error: .errorCode}"

답변 없음

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠