By using AWS re:Post, you agree to the Terms of Use
/CloudWatch-Insights: How to compare attributes on a query/

CloudWatch-Insights: How to compare attributes on a query


I am trying to search for messages on AWS Insights with either matching or non matching attributes.

Specifically, Suppose I have an attribute "resp" and I want to search for messages which do not contain att.resp. Is something like that even feasible on AWS Insights?

Trying to do something similar to:

fields @timestamp, @message
| sort @timestamp desc
| filter @message not like att.resp 
1 Answers

I think you are asking to find all events which don't have a value for the field att.resp? In which case, you can use the *filter *command with the *ispresent *function, for example

fields @timestamp, @message
| sort @timestamp desc
| filter NOT ispresent(att.resp 

If you want to see more on the Logs Insights syntax see

answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions