字符串包含的 AWS 日志洞察查询

小开

I think you need to select them as fields and then filter on their value. e.g:

fields @timestamp, @message, strcontains(@message, "user not found") AS unf
| filter unf=1
| sort @timestamp desc
| limit 20

Or use regex

fields @timestamp, @message
| filter @message like /User\snot\sfound/
| ...

(haven't tested them)

小开

最佳答案

This should work fine

fields @timestamp, @message
| filter @message like /user not found/
| sort @timestamp desc
| limit 20

小开

I was looking for contains and in filters. Allowed filtering options are:

'in', 'and', 'or', 'not', 'like', '=~', '~=', '|', '|>', '^', '*', '/', '%', '+', '-', '<', '>', '<=', '>=', '=', '!='

So the solution using like seems also the optimal version in terms of operator.

fields @timestamp, @message
| filter @message like /user not found/
| sort @timestamp desc
| limit 20

Nevertheless there's another possibility to parse the message itself and do an equal comparison for use cases where one needs to be more exact. For formatted log rows like:

2020-12-24T19:08:18.180+01:00 [main] INFO com.foo.bar.FooBar - My log message!

You can parse substrings from the message and assign them to a field which can then be filtered using equal operator ("="). In the example below you can see no "INFO" String in the message can interfere with filtering severity:

fields @timestamp, @message
| parse @message "[*] * *" as @level, @severity, @info
| filter @logStream like "my/stream/within/loggroup"
| filter @severity="INFO"
| sort @timestamp desc
| limit 20

小开

I recently ran into the same scenario. strcontains takes the input string as the first argument and the search value as the second. so in your case the following should work fine.

fields @timestamp, @message
| filter strcontains(@message, "User not found")
| sort @timestamp desc
| limit 20