0

I've got an AWS Cloudwatch log insights query where I want to filter out log entries where a JSON field contains a substring "DEBUG".
I cannot find this in the documentation and below is a bunch of stuff I've tried without success. Does anyone know if it is possible?

fields
Properties.addin_version
| stats count_distinct(@logStream) as users by Properties.addin_version
|filter ispresent(Properties.addin_version)
#|filter Properties.addin_version not like "*DEBUG*"
#|filter Properties.addin_version not like "%DEBUG%"
#|filter Properties.addin_version not like /*DEBUG*/ #this yields 0 results so it does something
#|filter Properties.addin_version != "*DEBUG*"
#|filter not(Properties.addin_version like "*DEBUG*")
#|filter Properties.addin_version !~ /.*DEBUG.*/i #syntax error, this was suggested by chatGPT
|sort Properties.addin_version

Here is an example log message

{
    "Timestamp": "2023-05-16T14:44:55.8178939+02:00",
    "Level": "Information",
    "MessageTemplate": "Addin loaded",
    "Properties": {
        "current_ui_culture": "en-US",
        "current_culture": "sv-SE",
        "addin_version": "2021.3.0.26527 DEBUG build",
        "revit_version": "Autodesk Revit 2021 (2021.1)",
        "log_level": "Information"
    }
}
Martin Riddar
  • 173
  • 4
  • 16

0 Answers0