6

Given the following query on CloudWatch that extracts logs with messages including "entry 1456" (where 1456 is an ID) how should I extend this to take multiple IDs and what is the corresponding CLI command?

fields  @message
| filter @message like "entry 1456"
| limit 10

To clarify I'd like to filter with multiple IDs, for instance "like 1456|1257|879". But not sure of the format of regex in such case.

And I assume the corresponding CLI command will be sth like:

aws logs filter-log-events 
--log-group-name group_name
--app
--filter-pattern ........

Just want to make sure of the best way to formulate this.

Dejan Peretin
  • 10,891
  • 1
  • 45
  • 54
OmaymaS
  • 1,671
  • 1
  • 14
  • 18

2 Answers2

12

The syntax would be:

fields  @message
| filter @message like /entry [1456|1257]/
| limit 10

You could also parse the logline first and extract the value, like this:

fields  @message
| parse @message /.*entry (?<id>\d+).*/
| filter id in [1257, 1456]
| limit 10

Now for the CLI, you would not use the filter-log-events, but the start-query and get-query-results.

Dejan Peretin
  • 10,891
  • 1
  • 45
  • 54
  • 6
    Thanks. The first works with parentheses () `fields @message| filter @message like /entry (1456|1257)/` – OmaymaS Feb 11 '20 at 14:29
2

Just for visibility and copy/paste ability the current correct syntax is :

fields @message
| filter @message like /entry (1457|1458)/
| limit 20
Higgs Bogson
  • 361
  • 2
  • 5