I have a scenario in which there are multiple api each of the api will contain orgId and objectiveId. Now I want to write a cloudwatch query to fetch all the logs for all below api's in the query but I don't want to create sperate variable for each api. Is this possible so far the cloudwatch query which I have created is this.
fields @timestamp, @message, @logStream, @log
| parse `log_processed.private.pulse-align.api` '/POST-/v1/orgs/*/objectives/*/keyresults/' as orgId1, objectiveId1
| parse `log_processed.private.pulse-align.api` 'PUT-/v1/orgs/*/objectives/*/checkins/meetings' as orgId2, objectiveId2
| parse `log_processed.private.pulse-align.api` 'POST-/v1/orgs/*/objectives/*/meetings' as orgId3, objectiveId3
| parse `log_processed.private.pulse-align.api` 'POST-/v1/orgs/*/objectives/*/keyresults' as orgId4, objectiveId4
| parse `log_processed.private.pulse-align.api` 'POST-/v1/orgs/*/objectives/*/keyresults/*/meetings' as orgId5, objectiveId5
| parse `log_processed.private.pulse-align.api` 'PATCH-/v1/orgs/*/objectives/*/keyresults/*/checkins/*/meetings' as orgId6, objectiveId6
| parse `log_processed.private.pulse-align.api` 'PATCH-/v1/orgs/*/objectives/*/watcher/*' as orgId7, objectiveId7
| parse `log_processed.private.pulse-align.api` 'PATCH-/v1/orgs/*/objectives/*/contributor/*' as orgId8, objectiveId8
| parse `log_processed.private.pulse-align.api` 'PATCH-/v1/orgs/*/objectives/*/keyresults/*/contributor/*' as orgId9, objectiveId9
| parse `log_processed.private.pulse-align.api` 'PATCH-/v1/orgs/*/objectives/*/keyresults/*/watcher/*' as orgId10, objectiveId10
| parse `log_processed.private.pulse-align.api` 'PATCH-/v1/orgs/*/objectives/*/status/ACTIVE' as orgId11, objectiveId11
| parse `log_processed.private.pulse-align.api` 'PATCH-/v1/orgs/*/objectives/*/keyresults/*/status/ACTIVE' as orgId12, objectiveId12
| parse `log_processed.private.pulse-align.api` '/POST-/v1/orgs/*/objectives/' as orgId13
| filter orgId1 = '63b9a1e6-cb19-4fe5-bbb0-c2f1e3468cae' AND orgId2 = '63b9a1e6-cb19-4fe5-bbb0-c2f1e3468cae'
AND orgId2 = '63b9a1e6-cb19-4fe5-bbb0-c2f1e3468cae' AND orgId4 = '63b9a1e6-cb19-4fe5-bbb0-c2f1e3468cae'
AND orgId5 = '63b9a1e6-cb19-4fe5-bbb0-c2f1e3468cae' AND orgId6 = '63b9a1e6-cb19-4fe5-bbb0-c2f1e3468cae'
AND orgId7 = '63b9a1e6-cb19-4fe5-bbb0-c2f1e3468cae' AND orgId8 = '63b9a1e6-cb19-4fe5-bbb0-c2f1e3468cae'
AND orgId9 = '63b9a1e6-cb19-4fe5-bbb0-c2f1e3468cae' AND orgId10 = '63b9a1e6-cb19-4fe5-bbb0-c2f1e3468cae'
AND orgId11 = '63b9a1e6-cb19-4fe5-bbb0-c2f1e3468cae'
| filter `log_processed.level`= "ERROR"
| sort @timestamp desc
in above query you can see I am creating sperate orgId and objectiveId.
