4

I have log events in CloudWatch whcih have certain fields like @timestamp and @message.

@timestamp looks like this:

2022-08-09T08:49:51.971+02:00

and @message like this:

2022-08-09 06:49:49.376 INFO [xyz, 123abc456] xxxxxxx

I can extract the time in @message by using something like this:

| parse @message /(?<messagetst>.+) INFO/ 

What I want to do is to

  1. convert the timestamp of @timestamp to UTC and a datetime format,
  2. convert the @message messagetst to a datetime format,
  3. substract @timestamp from messagetst.

Is this possible in CloudWatch and how can I do this?

Tobitor
  • 1,388
  • 1
  • 23
  • 58

0 Answers0