Group By after parsing a message in AWS cloudwatch insights

Question

I have messages which are like below, the following message is one of the messages (have so many JSON formats which are not at all related to this)

request body to the server {'sender': '65ddd20eac244AAe619383e4d8cb558834', 'message': 'hello'}

I would like to group of these messages based on sender (alphanumeric value) which is enclosed in JSON.

Answer 1

CloudWatch Logs Insights query:

fields @message |
filter @message like 'request body to the server' |
parse @message "'sender': '*', 'message'" as sender |
stats count(*) by sender

Query results:

-------------------------------------------------
|               sender               | count(*) |
|------------------------------------|----------|
| 65ddd20eac244AAe619383e4d8cb558834 |     4    |
| 55ddd20eac244AAe619383e4d8cb558834 |     3    |
-------------------------------------------------

Screenshot: