I have log events in CloudWatch whcih have certain fields like @timestamp
and @message
.
@timestamp
looks like this:
2022-08-09T08:49:51.971+02:00
and @message
like this:
2022-08-09 06:49:49.376 INFO [xyz, 123abc456] xxxxxxx
I can extract the time in @message
by using something like this:
| parse @message /(?<messagetst>.+) INFO/
What I want to do is to
- convert the timestamp of
@timestamp
to UTC and a datetime format, - convert the
@message
messagetst
to a datetime format, - substract
@timestamp
frommessagetst
.
Is this possible in CloudWatch and how can I do this?