AWS Log Insights query with string contains

Question

how to I query with contains string in AWS Log insights

fields @timestamp, @message filter @message = "user not found" | sort @timestamp desc | limit 20  fields @timestamp, @message filter @message strcontains("User not found") | sort @timestamp desc | limit 20 

Answer 1

This should work fine

fields @timestamp, @message | filter @message like /user not found/ | sort @timestamp desc | limit 20 

Answer 2

I think you need to select them as fields and then filter on their value. e.g:

fields @timestamp, @message, strcontains(@message, "user not found") AS unf | filter unf=1 | sort @timestamp desc | limit 20 

Or use regex

fields @timestamp, @message | filter @message like /User\snot\sfound/ | ... 

(haven't tested them)