I've got an AWS Cloudwatch log insights query where I want to filter out log entries where a JSON field contains a substring "DEBUG".
I cannot find this in the documentation and below is a bunch of stuff I've tried without success.
Does anyone know if it is possible?
fields
Properties.addin_version
| stats count_distinct(@logStream) as users by Properties.addin_version
|filter ispresent(Properties.addin_version)
#|filter Properties.addin_version not like "*DEBUG*"
#|filter Properties.addin_version not like "%DEBUG%"
#|filter Properties.addin_version not like /*DEBUG*/ #this yields 0 results so it does something
#|filter Properties.addin_version != "*DEBUG*"
#|filter not(Properties.addin_version like "*DEBUG*")
#|filter Properties.addin_version !~ /.*DEBUG.*/i #syntax error, this was suggested by chatGPT
|sort Properties.addin_version
Here is an example log message
{
"Timestamp": "2023-05-16T14:44:55.8178939+02:00",
"Level": "Information",
"MessageTemplate": "Addin loaded",
"Properties": {
"current_ui_culture": "en-US",
"current_culture": "sv-SE",
"addin_version": "2021.3.0.26527 DEBUG build",
"revit_version": "Autodesk Revit 2021 (2021.1)",
"log_level": "Information"
}
}