以下日志的 AWS cloudwatch 洞察查询组合

Question

Trying to compose an insight query which would extract the following fields.

apiname, endpoint, responseCode, status

from the log: "{\n \"apiName\": \"test_Authentication\",\n \"endpoint\": \"https://test.cloud.com\",\n \"responseCode\": 200,\n \"status\": \"Healthy\",\n}

As of now I am getting empty fields:

Answer 1

I tried with the parse message in the query which gave the result I am looking for.

| parse @message '"apiName\":*,' as apiName
| parse @message '"endpoint\":*,' as endpoint
| parse @message '"responseCode\":*,' as responseCode
| parse @message '"status\":*,' as status
| sort @timestamp desc
| limit 20