Search code examples
amazon-cloudwatchaws-cloudwatch-log-insights

In CloudWatch Insights, how do I filter out log entries that don't have a parsed value?

Suppose I have the following Insights query

fields @timestamp, @message
| parse @message 'status=*" as status
| display @timestamp, status, @message

Some log messages don't have a status. I'd like to filter those out. How do I do that?

Solution

  • You can use the ispresent() function: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html

    Like this:

    fields @timestamp, @message
| parse @message 'status=*" as status
| display @timestamp, status, @message
| filter ispresent(status)