[英]CloudWatch Insights query: Format a DateTime string for grouping
我有 json 格式的 CloudWatch 日志,其條目類似於:
{
"message": "resource_liked",
"context": {
"date": {
"date": "2021-05-07 16:52:11.000000",
"timezone_type": 3,
"timezone": "UTC"
},
...
我正在嘗試編寫一個 CloudWatch 洞察查詢來制作一個簡單的直方圖:每小時日志中的事件數。
但是,我不能使用日志條目的@timestamp
屬性。 我需要在條目的消息正文中使用context.date.date
。
使用@timestamp
編寫這個查詢很簡單:
stats count(*) by datefloor(@timestamp, 1h)
但是,我不確定如何使用消息的context.date.date
來代替。
我假設我需要將看起來像2021-05-07 16:52:11.000000
的日期時間格式化為 aws 理解為日期時間的東西,但我找不到如何。
stats count(*) by datefloor(context.date.date, 1h)
-> "Invalid Date"
stats count(*) by datefloor(toMillis(context.date.date), 1h)
-> "Invalid Date"
stats count(*) by datefloor(substr(context.date.date, 0, 19), 1h)
-> “無效日期”
stats count(*) by datefloor(concat(replace(substr(context.date.date, 0, 23), ' ', 'T'), '-00:00'), 1h)
-> 無效日期。 這使得該字段看起來與 @timestamp 的顯示方式完全相同。
| parse @message '"date": "*:' as hour
| stats count() as cnt by hour
可能有助於將字符串日期時間轉換為數值毫秒,請注意,由於閏年計算,最大年份為 2100。
fields "2021-05-07 16:52:11.000000" as reqDateTime
| parse reqDateTime "*-*-* *:*:*.*" as reqYear, reqM, reqD, reqH, reqMin, reqSec, reqMilliSec
| fields reqYear - 1970 as reqYearDiff, reqYear % 4 == 0 as reqIsLeapYear, reqM/1 as reqMonth, reqD/1 as reqDay, reqH/1 as reqHour, reqMin/1 as reqMinute, reqSec/1 as reqSecond, reqMilliSec/1 as reqMilliSecond
| fields ((reqYearDiff * 365) + ((reqYear % 4 == 1) * 1) + floor(reqYearDiff / 4) # as yearsToDays
+ ((reqMonth == 2) * 31) #
+ ((reqMonth == 3) * 59) #
+ ((reqMonth == 4) * 90) #
+ ((reqMonth == 5) * 120) #
+ ((reqMonth == 6) * 151) #
+ ((reqMonth == 7) * 181) #
+ ((reqMonth == 8) * 212) #
+ ((reqMonth == 9) * 243) #
+ ((reqMonth == 10) * 273) #
+ ((reqMonth == 11) * 304) #
+ ((reqMonth == 12) * 334) #
+ ((reqMonth > 2) and (reqIsLeapYear == 1)) # as monthsToDays
+ reqDay - 1) * 24 * 60 * 60 * 1000 # as daysToMilliSeconds
+ reqHour * 60 * 60 * 1000 # as hoursToMilliSeconds
+ reqMinute * 60 * 1000 # as minutesToMilliSeconds
+ reqSecond * 1000 # as secondsToMilliSeconds
+ reqMilliSecond
as reqMilliSeconds
| display reqMilliSeconds, fromMillis(reqMilliSeconds), reqYear, reqMonth, reqDay, reqHour, reqMinute, reqSecond, reqMilliSecond
| limit 1
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.