Cloudwatch Log Insights Query

0

I want to be able to filter the eventName of S3 by PutObject and CopyObject.

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter detail.eventName in ["PutObject", "CopyObject"]

The above query only returns 1 result which I expect more

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter detail.eventName in ["PutObject"]

Also returns one result

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter detail.eventName="PutObject"

Returns a few result which is correct.

How do I set the filter so that the result returns EventName is either PutObject and CopyObject.

profile picture
질문됨 8달 전779회 조회
1개 답변
1
수락된 답변

Try this and let me know if it works:

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter (detail.eventName="PutObject" or detail.eventName="CopyObject")
profile picture
전문가
답변함 8달 전
profile picture
전문가
검토됨 8달 전
  • Yes, it works! What didn't "in" work when applying it to the filter?

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠