In CloudWatch Insights, how do I filter out log entries that don't have a parsed value?

Question

Suppose I have the following Insights query

fields @timestamp, @message
| parse @message 'status=*" as status
| display @timestamp, status, @message

Some log messages don't have a status. I'd like to filter those out. How do I do that?

Answer 1

You can use the ispresent() function: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html

Like this:

fields @timestamp, @message
| parse @message 'status=*" as status
| display @timestamp, status, @message
| filter ispresent(status)