4

For my aws loggroups, I want to write a cloudwatch log insgights query to search for multiple strings in the logs. I tried something like this :

fields @timestamp, @message, @logStream
| filter @message like /(?i)\$\{jndi/
| filter @message like /(?i)\$\{\$\{lower\:j/
| sort @timestamp desc

But, it only searches for first filter which is /(?i)${jndi/ . It does not search for 2nd filter. Can someone help me to find out how can I search for multiple strings using one query?

I could not find any example in aws documents and over internet

Thanks for any help.

Sushil
  • 8,250
  • 3
  • 39
  • 71

3 Answers3

6

@Zabih Khaliqi your code snipped will only find results, if message is exactly one of the values in the list.

If @Sushil is searching "is string in message" I would suggest something like this:

fields @timestamp, @message
| filter strcontains(@message, "jndi") or strcontains(@message, "lower\:j")
| sort @timestamp desc

So using the OR operator of and string operators https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html#CWL_QuerySyntax-operations-functions

Daniel Seichter
  • 809
  • 1
  • 8
  • 14
1

Use the in operator, like following: AWS Documentation

fields @timestamp, @message, @logStream
| filter @message in ["MyFirstSearchString", "MySecondSearchString", "MyThirdSearchString"]
| sort @timestamp desc
Zabih Khaliqi
  • 49
  • 4
  • 1
    This does not work in the way the OP was asking for. Looking for a string within the message, not the message to literally be equal to it. – Taylor Brown Jul 21 '22 at 16:49
0

This woked for me :

fields @timestamp, @message, @logStream | filter @message like /(?i)(${jndi|${${lower:j|${${upper:j|${${::-j)|${/ | sort @timestamp desc

Sushil
  • 8,250
  • 3
  • 39
  • 71