0

I have a use case where I have logs as below: LINE1 : {id : 123, name : "ABC"} LINE2 : {id : 123, city : "NYC"}

I want to query the log group and join 2 log lines with id field and get Output as : {name : "ABC", city : "NYC"}

Is there a way to do this in cloud watch log insights? This is like a join or using output of one query into another.

I have separate queries with me but I am not sure how to combine those into one:

Query 1: filter @message like /name : / | parse 'id : [ * ], name : [ * ]' as id, name

Query 2: filter @message like /city : / | parse 'id : [ * ], city : [ * ]' as id, city

Divyesh Kalbhor
  • 385
  • 3
  • 19
  • have you seen this post, which I have used to do something similar - https://saturncloud.io/blog/how-to-combine-two-cloudwatch-insights-queries/#:~:text=Combining%20two%20Cloudwatch%20Insights%20queries,average%20on%20the%20combined%20data. – Ricardo Sueiras Jul 27 '23 at 11:08

0 Answers0