0

We have a field for "url" in our logs, and I'd like to be able to filter down to just requests hitting the homepage. This would be requests for / and for /?*, i.e. with any query string.

Just getting homepage requests is | filter url = "/" but how do you include those requests that have a query string also?

Timm
  • 12,553
  • 4
  • 31
  • 43

1 Answers1

1

You can use regex: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html

Something like this should work:

filter url = "/" or url like /^\/\?.*/
Dejan Peretin
  • 10,891
  • 1
  • 45
  • 54