0

Is it possible to query log insights data and filter based on IP addresses that start with specific values. The query below is returning too much data... In addition to returning data that begin with 98, it is also returning data with IP addresses that have 98 in the middle of the string.

fields @timestamp, @message, @logStream, @log
| filter (event.src_ip like /98./) 
| sort @timestamp desc
| limit 20
Paul Wasserman
  • 137
  • 2
  • 13

1 Answers1

0

I believe I have found the answer using Regular Expressions. I needed to use the ^ character at the beginning of the expression.

fields @timestamp, @message, @logStream, @log
| filter (event.src_ip like /^98./) 
| sort @timestamp desc
| limit 20
Paul Wasserman
  • 137
  • 2
  • 13