By using AWS re:Post, you agree to the Terms of Use
Questions in Storage
Sort by most recent

Browse through the questions and answers listed below or filter and sort to narrow down your results.

create-export-task | Filter CloudWatch logs using JMESpath

My objective is to create a mechanism for exporting CloudWatch logs to S3 on a case-by-case basis. Given my logs appear in the following format: ``` { "level": "error", "message": "Oops", "errorCode": "MY_ERROR_CODE_1" } { "level": "info", "message": "All good" } { "level": "info", "message": "Something else" } ``` I'd like the export to **only** include the error logs. Using [create-export-task](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/logs/create-export-task.html), is it possible to use the `query` param to filter the response data given the above log structure? I'm not sure whether the log structure is incorrect for this use or if I have misunderstood the purpose of the query param. My JMESPath attempts so far have been unsuccessful. Some attempts include: ``` aws logs create-export-task \ --log-group-name myGroup \ --log-stream-name-prefix myGroup-test \ --from 1664537580000 \ --to 1664537640000 \ --destination myGroup-archive-ab1 \ --destination-prefix test \ --query '{Message: message, Error: errorCode}' ``` and same command, but with the following query `--query '{Message: .message, Error: .errorCode}'` which produces the following error: *Bad value for --query {Message: .message, Error: .errorCode}: invalid token: Parse error at column 10, token "." (DOT), for expression: "{Message: .message, Error: .errorCode}"*
0
answers
0
votes
10
views
asked a day ago