16

Is there any way to get the length of an array found in a JSON object parsed by cloud watch log insights?

For example, when sending a JSON object of the following structure to log insights:

{
  names: ['john', 'doe', 'joe', 'schmoe']
}

it gets parsed into the following fields:

  names.0: john
  names.1: doe
  names.2: joe
  names.3: schmoe

and can be accessed by 

fields @timestamp, names.0, names.1, ...

In this example, is there a way to get a field called number_of_names?

  • e.g., | parse get_length(names) as number_of_names
Ulad Kasach
  • 11,558
  • 11
  • 61
  • 87

1 Answers1

3

Here is an ugly workaround for smaller arrays where the max length is known:

fields @timestamp, ispresent(names.0) + ispresent(names.1) + ispresent(names.2) + ... + ispresent(names.10) as names_length
Johann
  • 31
  • 3