Cloudwatch insights query modification

Question

Current query :
fields  @message
| filter @message like /ABCD/
| stats count(@message)

result: @messages 1 55 now need to add more like a filter in this query like/BCDE/,/EFGH/,/IJKL/..... the expected result should be like @ABCD @BCDE @EFGH @IJKL... 55 66 77 88.

Can get like this? all the search keywords must be searched in the entire CloudWatch log.

score 7 · Answer 1 · answered Mar 08 '19 at 08:25

7

This should work for you:

fields  @message
| filter @message like /ABCD|BCDE|EFGH|IJKL/ 
| fields strcontains(@message, "ABCD") as @CONTAINS_ABCD,
         strcontains(@message, "BCDE") as @CONTAINS_BCDE,
         strcontains(@message, "EFGH") as @CONTAINS_EFGH,
         strcontains(@message, "IJKL") as @CONTAINS_IJKL
| stats sum(@CONTAINS_ABCD) as @ABCD, 
        sum(@CONTAINS_BCDE) as @BCDE, 
        sum(@CONTAINS_EFGH) as @EFGH, 
        sum(@CONTAINS_IJKL) as @IJKL

answered Mar 08 '19 at 08:25

Dejan Peretin

10,891
1
45
54

its working fine, need one more suggestion if we dont get an output how to replace the result with zero's? – Kiran Kumar Mar 20 '19 at 11:05
How can i implement the query in AWS cloudwatch API ? – Kiran Kumar Apr 09 '19 at 09:28
Excellent query for matching partial results and counting them. thanks. – Hugo Allexis Cardona Apr 14 '20 at 00:15

Cloudwatch insights query modification

1 Answers1