1

Is there a way to filter in a widget only the @LogStream s which do not contain a specific log message?

I tried to use a Log table with some filters as presented in: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html and: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html#CWL_QuerySyntax-regex

As I understand the filters apply to messages, but I need a way to filter and select at Log stream level.

Tried something like this:

fields @logStream, strcontains(@logStream, "[INFO] - My message") as found

| filter found=0

| display @logStream

| limit 20

But the filter is not working, it's displaying all the messages.

Thank you!

Keb
  • 11
  • 1
  • 3

2 Answers2

1

Your strcontains(@logStream, "[INFO] - My message") as found part of your query looks incorrect to me. I think you meant for this to be: strcontains(@message, "[INFO] - My message") as found?

shawnjohnson
  • 375
  • 6
  • 19
1

you can filter by logstream:

filter @logStream = 'xxx/yyy/5d4d93708e4e42a1924fb4a1f7003ccd' | fields @timestamp, @message

Rafa
  • 31
  • 3