How do I use the replace command to change the value of a custom field?

Question

CloudWatch documentation on page https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-operations-functions.html shows the existence of a replace command but there is no example of how to use it.

Could someone give an example of how to replace the content of a custom field?

I am trying to make a table out of some logs and wanted to change some of the values for mor human readable values. Some fields shows a code and I would like to change those codes for its meaning so the people I send the table doesn't need to be looking up for the values on a different document.

When I used Splunk, I could submit a sheet to the engine and it will do the transformations for me but I don't know how to do this on CloudWatch.

Any help would be greatly appreciated.

Thank you.

Miguel · Answer

How could I make it work when I have four platform codes?

This display things like...

```
'WWAndroidI'
```

Each replace line is adding a single character.

Any ideas?

I thought there would be some sort of 'if' command so I could do some conditional like if(platformCode = "N", "Native") or similar thing.

Miguel · Answer

I found the way, below a sample query...

```
fields @message
| filter @message like 'userDetails'
| parse @message "M as platformCode
| fields replace(platformCode, "M", "Mobile Native") as platform
| display platform
```

Miguel · Answer

I finally made it work...

```
fields @message 
| filter @message like 'userDetails' 
| parse @message "* as platformCode 
| fields if(platformCode = "W", "Web", if(platformCode = "A", "Android", if(platformCode = "I", "iPhone", ""))) as thePlatform
| display thePlatform
```

How do I use the replace command to change the value of a custom field?

Relevant content