12

I have a Log Group with this kind of messages.

{
  "m": [
    {
      "id": "5b6973c7c86e8689368b4569",
      "ts": 1634112000.062
    },
        {
      "id": "6116d21e02e38f5045079c42",
      "ts": 1634120807.402
    },
    {
      "id": "60c368ff1085fc0d546fad52",
      "ts": 1634120807.512
    },
    {
      "id": "6053536817a46610797ed472",
      "ts": 1634120809.249
    }
  ]
}

I want to run a query over the field m.*.ts (It's an array). Something like this...

fields @message
| filter (m.*.ts > 1634112000.062 and m.*.ts < 1634120807.000 )

It's posible?

icalvete
  • 987
  • 2
  • 16
  • 50

2 Answers2

0
fields @message
  | parse @message "[*] *" as id, ts
  | filter (ts > 1634112000.062 and ts <  1634120807.000)
smcrowley
  • 451
  • 3
  • 10
0

Hi I don't know what format you want, so try this and you can adapt it, many more samples here on AWS

Option 1: helps you break it down in steps to debug

fields @message
  |"[*] *" as id, ts
  | filter ts > 1634112000.062 
  | filter ts < 1634120807.000

Option 2:

fields @message
  | parse @message '[] * {"*"}' as id, ts
  | filter (ts > 1634112000.062 and ts <  1634120807.000)
Transformer
  • 6,963
  • 2
  • 26
  • 52