CloudWatch-Insights: How to compare attributes on a query

Question

I am trying to search for messages on AWS Insights with either matching or non matching attributes.

Specifically, Suppose I have an attribute "resp" and I want to search for messages which do not contain att.resp. Is something like that even feasible on AWS Insights?

Trying to do something similar to:

```
fields @timestamp, @message
| sort @timestamp desc
| filter @message not like att.resp 
```

Answer

I think you are asking to find all events which don't have a value for the field att.resp?
In which case, you can use the *filter *command with the *ispresent *function, for example
 
```
fields @timestamp, @message
| sort @timestamp desc
| filter NOT ispresent(att.resp 
```

If you want to see more on the Logs Insights syntax see https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html.

CloudWatch-Insights: How to compare attributes on a query

Relevant questions

AWS Rekognition: Search Faces in a Collection issue

How to Search across all hosted zones for records either by name of record or IP address.

How to use SNS or SQS on Unreal with FlexMatch

How to pass SQS attributes when IOT rule is triggered?

Unable to map AWS SSO Attributes to SAML Assertion values

Lambda function to query Kendra for Lex Response

WorkDocs Error - "Missing Attributes. This page requires several GET attributes and/or cookies to be set"

CloudWatch-Insights: How to compare attributes on a query

Cognito Identity Pools Attribute-based access control - dynamic attributes

Filter Expression can only contain non-primary key attributes ?