0

I would like to send a query to AWS Cloudwatch Log Insights using a NodeJS server. Heres the query string as it runs in the AWS console:

parse "* \"*\"" as tag, userMessage 
| filter tag="TEST"

I would like to execute this query using AWS Cloudwatches 'aws-sdk' library, so I'm trying to load this into the cloudwatch.startQuery params, like so:

cloudwatch.startQuery({
    startTime: new Date().getTime() - 100000,
    endTime: new Date(),
    logGroupName: "my/test/group",
    queryString: `parse "* \\"*\\"" as tag, userMessage | filter tag="TEST"`
});

But when I run this, I get an error saying:

MalformedQueryException: mismatched input '*' expecting K_AS

I've tried various forms of this where I try more or less backslashes, but no matter what I get this error. Does anyone know how to properly format this so AWS Cloudwatch will understand?

MustachedNinja
  • 87
  • 9
  • I would try **`parse "* \\\\"*\\\\"" as tag, userMessage | filter tag="TEST"`** probably it removes escape character twice on the way – slkorolev Jul 21 '20 at 08:47
  • So for some reason, when I set it to use 4 backslashes, it stops complaining about the formatting, but when I check the logs of the queries that were run, it says that the parsed query had 2 backslashes. This time, removing one backslash and going back to 3 backslashes, it seemed to be formatted correctly. I'm not sure why that was. Thank you for the help! – MustachedNinja Jul 23 '20 at 17:43

0 Answers0