Cannot filter using the isValidIp function in CloudWatch

Question

Hi

I'm currently experiencing issues when trying to use the "isValidIp" function for filtering logs in CloudWatch

```
fields @timestamp, StatusCode, RequestPath, @@m, isValidIp(Host),!(isValidIp(Host))
| filter !(isValidIp(Host))
```

I expect the query above to filter all logs where "Host" is not a valid IP address, but nothing is being filtered.
At the same time, I render `isValidIp(Host)` and `!(isValidIp(Host))` and see that these can clearly render the correct values for the function.

Is there some limitation or is my syntax incorrect?

Here is a link to a screenshot of the query and results: https://ibb.co/NSM8qM3

Answer

I couldn't see the screenshot you shared, so I'm guessing a little here...

*IsValidIp* will return a boolean (true if valid), so I think you will need to use it in a condition in filter.

For example
```
| filter isValidIp(Host)
```
Hope that helps!

Cannot filter using the isValidIp function in CloudWatch

Relevant questions

PutLogEvents with timeStamp in past breaks Cloudwatch Insights

Log Subscription Filter To Opensearch

AWS step function giving error, when I had included the "Parameter" tag

Filtering CloudWatch Insights by timestamp with date range

Cannot filter using the isValidIp function in CloudWatch

CloudWatch-Insights: How to compare attributes on a query

How can you filter by json property in cloudwatch log?

Run a Lambda function for RDS using the DBInstanceIdentifier

Can I use CloudWatch Logs to trigger a Lambda function?

Start & Stop of EC2 instance using tags in Lambda function