Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Cloudwatch Insights search in multiline logs

Tags:

Example log:

REQUEST-ID:123 Video id=444
REQUEST-ID:123 Request=error
REQUEST-ID:534 Video id=555
REQUEST-ID:534 Request=ok

Question, how to find Video id of all requests with an error?

like image 917
Alexander Matrosov Avatar asked Jan 30 '20 12:01

Alexander Matrosov


People also ask

How do I search multiple CloudWatch logs?

To search all log entries for a time range using the consoleOpen the CloudWatch console at https://console.aws.amazon.com/cloudwatch/ . In the navigation pane, choose Log groups. For Log Groups, choose the name of the log group containing the log stream to search. Choose Search log group.


1 Answers

Here is the official response from AWS support:

Currently, we do not have support for nested queries, and hence your use-case won't be achievable with Insights. However, we can confirm that we have a feature request existing at our end for this use-case. We don't have an ETA now on when this will be implemented. I hope you understand. Please keep a watch on below link for any new feature updates:

https://aws.amazon.com/new/

As a workaround, for now, you could download partial query results(Run the query -> Actions -> Export -> Download query results(CSV) and filter the results to identify the video ids. Please find below one sample query that can help you in this case:

fields @timestamp, @message
| parse @message 'REQUEST-ID:* Request=*' as REQUESTID,Request
| parse @message 'REQUEST-ID:* Video id=*' as REQUESTIDVID,Videoid
| DISPLAY REQUESTID,Request,REQUESTIDVID,Videoid
like image 53
Alexander Matrosov Avatar answered Oct 03 '22 05:10

Alexander Matrosov