amazon-web-services amazon-cloudwatch aws-cloudwatch-log-insights

在CloudWatch Insights Log中解析JSON消息

发布于 2025-02-10 15:31:54 字数 445 浏览 2 评论 0原文

假设我当前的查询如下：

fields @timestamp, @message
| sort @timestamp desc
| limit 20

我的消息由有效的JSON组成，例如：

{ "timestamp": "2022-06-24T04:03:17,962", "logger": "com.log.LoggerClass", "level": "DEBUG"}

我想做的就是能够将JSON分析到离散字段中，以便我可以按照以下方式进行操作：带有级别的消息：错误和致命：

fields @timestamp, @message
| filter @message.level like /(?i)error|fatal/ 
| sort @timestamp desc
| limit 20

原文

Lets say my current query is as follows:

fields @timestamp, @message
| sort @timestamp desc
| limit 20

Where my messages consist of valid JSON, such as:

{ "timestamp": "2022-06-24T04:03:17,962", "logger": "com.log.LoggerClass", "level": "DEBUG"}

What I would like to do is to be able to parse the JSON into discrete fields such that I can do something along the lines of: find all the messages with level: errors and fatals:

fields @timestamp, @message
| filter @message.level like /(?i)error|fatal/ 
| sort @timestamp desc
| limit 20

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

肩上的翅膀 2025-02-17 15:31:54

您可以使用以下查询：

fields @timestamp, @message, time, logger, level
| filter level like /(?i)error|fatal/
| limit 20
| display @message

对于此日志文件：

{ "timestamp": "2022-06-24T04:03:17,962", "logger": "com.log.LoggerClass", "level": "DEBUG"} 
{ "timestamp": "2022-06-24T04:03:18,962", "logger": "com.log.LoggerClass", "level": "ERROR"} 
{ "timestamp": "2022-06-24T04:03:19,962", "logger": "com.log.LoggerClass", "level": "ERROR"} 
{ "timestamp": "2022-06-24T04:03:20,962", "logger": "com.log.LoggerClass", "level": "DEBUG"}
{ "timestamp": "2022-06-24T04:03:21,962", "logger": "com.log.LoggerClass", "level": "ERROR"} 
{ "timestamp": "2022-06-24T04:03:22,962", "logger": "com.log.LoggerClass", "level": "DEBUG"}
{ "timestamp": "2022-06-24T04:03:23,962", "logger": "com.log.LoggerClass", "level": "FATAL"}

查询的输出将为：

You can use the following query:

fields @timestamp, @message, time, logger, level
| filter level like /(?i)error|fatal/
| limit 20
| display @message

For this log file:

{ "timestamp": "2022-06-24T04:03:17,962", "logger": "com.log.LoggerClass", "level": "DEBUG"} 
{ "timestamp": "2022-06-24T04:03:18,962", "logger": "com.log.LoggerClass", "level": "ERROR"} 
{ "timestamp": "2022-06-24T04:03:19,962", "logger": "com.log.LoggerClass", "level": "ERROR"} 
{ "timestamp": "2022-06-24T04:03:20,962", "logger": "com.log.LoggerClass", "level": "DEBUG"}
{ "timestamp": "2022-06-24T04:03:21,962", "logger": "com.log.LoggerClass", "level": "ERROR"} 
{ "timestamp": "2022-06-24T04:03:22,962", "logger": "com.log.LoggerClass", "level": "DEBUG"}
{ "timestamp": "2022-06-24T04:03:23,962", "logger": "com.log.LoggerClass", "level": "FATAL"}

the output of the query will be: