0

I want to use create-export-task to store some logs into S3.

Given my CloudWatch logs appear in the following format:

{ "message": "Example message", "errorCode": "MY_ERROR_CODE_1", "someFlag": "flag", "otherFlag": "flag2", "level": "error" }
{ "message": "All good", "level": "info" }

Is it possible to use the query param to filter the response data given the above log structure?

My JMESPath attempts so far have been unsuccessful (e.g. --query "level" to only get the level data). I'm not sure whether the log structure is incorrect for this use or if I have misunderstood the purpose of the query param.

evonzz
  • 139
  • 6

1 Answers1

0

You can filter multiple identifiers with the output from an AWS CLI.

For example, in your case, to get information about message, and errorCode, you can use the following query:

--query '{Message: .message, Error: .errorCode}'

In above query:

  • Message is a label for message in the output of the CLI
  • Error is a label for errorCode in the output of the CLI

For more information, you can visit here: https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-filter.html

Hieu
  • 257
  • 2
  • 5
  • Unfortunately, that too doesn't seem to have an effect on the export. – evonzz Sep 30 '22 at 17:30
  • You can use [describe-export-tasks](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/logs/describe-export-tasks.html) to filter information you need based on the output of `describe-export-tasks` – Hieu Sep 30 '22 at 22:20
  • describe-export-tasks only seems to return metadata about create-export-task requests. It also can't filter the logs export as far as I can tell. – evonzz Oct 06 '22 at 14:25
  • @evonzz Can you send some example of output? – Hieu Oct 07 '22 at 11:14
  • { "exportTasks": [ { "taskId": "193..", "taskName": "myG..", "logGroupName": "myG..", "from": 1664146800000, "to": 1664459190641, "destination": "archive...", "destinationPrefix": "110939", "status": { "code": "COMPLETED", "message": "Completed succ..." }, "executionInfo": { "creationTime": 1665161930124, "completionTime": 1665161947665 } } ] } – evonzz Oct 09 '22 at 20:26