Extract and Display First Part of a Field in CloudWatch Query Results

0

I am trying to write a CloudWatch Log Insights query which will extract the first part of a string field up to a forward slash '/' character, which is always present in the string. Example input log lines for field named "fruit" follow: blue/berries red/apple

I need to extract the first part of the "fruit" field up to the forward slash '/' character and display it in the query results as follows, using the example input lines above: blue red

The "fruit" field is not a blob field, e.g., JSON--it's just a single string. I tried various iterations using the parse command with no luck. I also tried different ideas for using a regular expression to extract the first part of the string up to the forward slash '/' character with no luck. I searched for hints in StackOverflow too but didn't land on anything successful.

I have verified using a regular expression checker that the following will extract the first part of the string up to the forward slash character: /^.*?(?=/)/

I haven't been able to figure out how to apply the regular expression in the query correctly so that it is evaluated and displayed. Any ideas? Thank you.

질문됨 일 년 전482회 조회
1개 답변
0
수락된 답변

Hello,

If the logs are in pure JSON format, CloudWatch Logs automatically discovers the log fields contained in the logs and you can reference the field directly as in the query below.


parse fruit "*/*" as color, product
 | display color

Note: color, product are variable names here.

If the logs are in non-JSON format , we would require a sample log to build the query. Keeping in mind your data privacy, you can open a technical support case with AWS using the link (https://console.aws.amazon.com/support) and then share a sample log on the case. AWS Premium Support engineers will assist you accordingly.

AWS
지원 엔지니어
답변함 일 년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠