Cloudwatch Log Insights Query

0

I want to be able to filter the eventName of S3 by PutObject and CopyObject.

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter detail.eventName in ["PutObject", "CopyObject"]

The above query only returns 1 result which I expect more

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter detail.eventName in ["PutObject"]

Also returns one result

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter detail.eventName="PutObject"

Returns a few result which is correct.

How do I set the filter so that the result returns EventName is either PutObject and CopyObject.

profile picture
Lottie
asked 3 months ago541 views
1 Answer
1
Accepted Answer

Try this and let me know if it works:

fields @timestamp, @message, @logStream, @log, detail.eventName
| sort @timestamp desc
| limit 1000
| filter (detail.eventName="PutObject" or detail.eventName="CopyObject")
profile picture
EXPERT
answered 3 months ago
profile picture
EXPERT
reviewed 3 months ago
  • Yes, it works! What didn't "in" work when applying it to the filter?

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions