AWS cloudwatch insight query composition for the following log

Question

Trying to compose an insight query which would extract the following fields.

apiname, endpoint, responseCode, status

from the log: "{\n \"apiName\": \"test_Authentication\",\n \"endpoint\": \"https://test.cloud.com\",\n \"responseCode\": 200,\n \"status\": \"Healthy\",\n}

As of now I am getting empty fields:

Does the log actually have \" in it and does the actual log line start with " or is that just you trying to show the string contained in the log? — luk2302, Aug 03 '22 at 06:48

score 0 · Accepted Answer · answered Aug 03 '22 at 21:21

I tried with the parse message in the query which gave the result I am looking for.

| parse @message '"apiName\":*,' as apiName
| parse @message '"endpoint\":*,' as endpoint
| parse @message '"responseCode\":*,' as responseCode
| parse @message '"status\":*,' as status
| sort @timestamp desc
| limit 20

AWS cloudwatch insight query composition for the following log

1 Answers1