有什么方法可以显示我不想在CloudWatch日志上统计数据的另一个字段

发布于 2025-01-31 03:36:05 字数 700 浏览 4 评论 0原文

我正在尝试为我们的CloudWatch日志见解编写查询，以便我可以根据错误查看更多信息。我写的查询是这样的：

      FIELDS coalesce(error.message, err.message) as errorMessage,
             coalesce(error.type, err.type) as errorType
             level
             | FILTER @message like /(?i)(Exception|Error)/
             | stats count(*) as count by errorMessage, level, errorType

我想在 @message 上包括 output ，所以我也可以看到堆栈跟踪，但是无论我尝试什么，我都无法让它工作。我似乎找不到AWS文档上的任何东西，所以这样的事情是可能的吗？

我得到的结果是：

errormessage，级别，errortype，count

我试图拥有

errormessage，last，errortype，count，@message，@message

我没有每个错误消息只需一个错误消息，因此我也会得到堆栈跟踪和计数。

原文

I'm trying to write a query for our cloudwatch log insights so I can see more information based on errors. The query I wrote is this:

      FIELDS coalesce(error.message, err.message) as errorMessage,
             coalesce(error.type, err.type) as errorType
             level
             | FILTER @message like /(?i)(Exception|Error)/
             | stats count(*) as count by errorMessage, level, errorType

I want to include the @message on the output so I can see the stack trace too, but no matter what I try I can't get it to work.
I can't seem to find anything on aws documenation, so is something like this possible?

The result I'm getting:

errorMessage, level, errorType, count

The result I'm trying to have

errorMessage, level, errorType, count, @message

I don't need each error message just one error message so I get the stack trace and the count too.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

木落 2025-02-07 03:36:05

您需要使用文档统计数据非聚合函数“选择单个@message以在每个汇总结果行中包含。例如，您可以使用最早的或最新：

 FIELDS coalesce(error.message, err.message) as errorMessage,
             coalesce(error.type, err.type) as errorType
             level
             | FILTER @message like /(?i)(Exception|Error)/
             | stats count(*), earliest(@message) as count by errorMessage, level, errorType

You need to use what the documentation calls a "Stats non-aggregation function" to select the single @message to include with each aggregated result line. For example, you can use earliest or latest:

 FIELDS coalesce(error.message, err.message) as errorMessage,
             coalesce(error.type, err.type) as errorType
             level
             | FILTER @message like /(?i)(Exception|Error)/
             | stats count(*), earliest(@message) as count by errorMessage, level, errorType

回复收藏 0 原文

~没有更多了~