Count Array Length in JSON Message Object with Amazon Cloudwatch Logs Insights

Question

Is there any way to get the length of an array found in a JSON object parsed by cloud watch log insights?

For example, when sending a JSON object of the following structure to log insights:

{
  names: ['john', 'doe', 'joe', 'schmoe']
}

it gets parsed into the following fields:

  names.0: john
  names.1: doe
  names.2: joe
  names.3: schmoe

and can be accessed by

fields @timestamp, names.0, names.1, ...

In this example, is there a way to get a field called number_of_names?

• e.g., | parse get_length(names) as number_of_names

Answer 1

Here is an ugly workaround for smaller arrays where the max length is known:

fields @timestamp, ispresent(names.0) + ispresent(names.1) + ispresent(names.2) + ... + ispresent(names.10) as names_length