Styjun

Do universities maintain secret textbooks?

How did the Altair 8800 front panel load the program counter?

Why do motor drives have multiple bus capacitors of small value capacitance instead of a single bus capacitor of large value?

Ways you can end up paying interest on a credit card if you pay the full amount back in due time

Can authors email you PDFs of their textbook for free?

Is there research on the efficacy of taking good notes in math class?

From not IT background to being a programmer

Fishing from underwater domes

Is Chuck the Evil Sandwich Making Guy's head actually a sandwich?

Are there consequences for not filing a DMCA (any country)

Correct way of simplifying the result of an integral

Does the telecom provider need physical access to the SIM card to clone it?

What are ways to record who took the pictures if a camera is used by multiple people?

How can I store milk for long periods of time?

Why do fuses burn at a specific current?

Why do presidential pardons exist in a country having a clear separation of powers?

Could a simple hospital oxygen mask protect from aerosol poison?

Turn off Google Chrome's Notification for "Flash Player will no longer be supported after December 2020."

Why is Mitch McConnell blocking nominees to the Federal Election Commission?

Was there an original & definitive use of alternate dimensions/realities in fiction?

meaning of "educating the ice"?

Why wasn't Linda Hamilton in T3?

What are the electrical characteristics of a PC gameport?

In Toy Story, are toys the only inanimate objects that become alive? And if so, why?

Amazon Cloudwatch Logs Insights parse with regex

Match all occurrences of a regexA comprehensive regex for phone number validationHow to negate specific word in regex?A Regex that will never be matched by anythingRegEx match open tags except XHTML self-contained tagsRegex to parse formatter stringParsing text using RegexParse encoded url with regexAmazon Cloudwatch Logs Insights with JSON fieldsCloudWatch Logs Insights Parse Syntax

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

11

I'm trying to extract an ephemeral field with the parse command. Unfortunately, the log format is such that the glob expression is not enough for it, thus I need to use regex. The regex itself is fine, but I just can't make the command to extract anything.

I'm trying with:

parse @endpoint /^([a-zA-Z_]+)[/|?]*.*/ as @clean_endpoint

The first group is what I'm after here and I did try with different kinds of quotes etc. It might be just a stupid formatting error, but I just cant' find it.

Pretty much the only documentation mentioning the parse command is here and the example there is using the glob expressions. Couldn't find any examples by googling either.

So anyone bumped into this and solved it?

regex amazon-cloudwatchlogs amazon-cloudwatch

share|improve this question

edited Feb 28 at 9:56

Joseph

631414 bronze badges

asked Feb 28 at 7:18

tnissitnissi

47044 silver badges1111 bronze badges

add a comment | 

11

I'm trying to extract an ephemeral field with the parse command. Unfortunately, the log format is such that the glob expression is not enough for it, thus I need to use regex. The regex itself is fine, but I just can't make the command to extract anything.

I'm trying with:

parse @endpoint /^([a-zA-Z_]+)[/|?]*.*/ as @clean_endpoint

The first group is what I'm after here and I did try with different kinds of quotes etc. It might be just a stupid formatting error, but I just cant' find it.

Pretty much the only documentation mentioning the parse command is here and the example there is using the glob expressions. Couldn't find any examples by googling either.

So anyone bumped into this and solved it?

regex amazon-cloudwatchlogs amazon-cloudwatch

share|improve this question

edited Feb 28 at 9:56

Joseph

631414 bronze badges

asked Feb 28 at 7:18

tnissitnissi

47044 silver badges1111 bronze badges

add a comment | 

I'm trying to extract an ephemeral field with the parse command. Unfortunately, the log format is such that the glob expression is not enough for it, thus I need to use regex. The regex itself is fine, but I just can't make the command to extract anything.

I'm trying with:

parse @endpoint /^([a-zA-Z_]+)[/|?]*.*/ as @clean_endpoint

The first group is what I'm after here and I did try with different kinds of quotes etc. It might be just a stupid formatting error, but I just cant' find it.

Pretty much the only documentation mentioning the parse command is here and the example there is using the glob expressions. Couldn't find any examples by googling either.

So anyone bumped into this and solved it?

regex amazon-cloudwatchlogs amazon-cloudwatch

share|improve this question

edited Feb 28 at 9:56

Joseph

631414 bronze badges

asked Feb 28 at 7:18

tnissitnissi

47044 silver badges1111 bronze badges

parse @endpoint /^([a-zA-Z_]+)[/|?]*.*/ as @clean_endpoint

share|improve this question

edited Feb 28 at 9:56

Joseph

631414 bronze badges

asked Feb 28 at 7:18

tnissitnissi

47044 silver badges1111 bronze badges

share|improve this question

edited Feb 28 at 9:56

Joseph

631414 bronze badges

asked Feb 28 at 7:18

tnissitnissi

47044 silver badges1111 bronze badges

edited Feb 28 at 9:56

Joseph

631414 bronze badges

edited Feb 28 at 9:56

Joseph

631414 bronze badges

asked Feb 28 at 7:18

tnissitnissi

47044 silver badges1111 bronze badges

asked Feb 28 at 7:18

tnissitnissi

47044 silver badges1111 bronze badges

1 Answer
1

active

oldest

votes

4

Try another approach, like

parse @message /(?<@endpt>(/[a-zA-Z0-9_]+)1,)/
| stats count_distinct(@endpt) by @endpt

or, alternatively, consider the solution

fields @timestamp
| parse @message /(?<@endpt_post>POST (/[a-zA-Z0-9_]+)1,)/
| parse @message /(?<@endpt_get>GET (/[a-zA-Z0-9_]+)1,)/
| stats count() by @endpt_post, @endpt_get

Good luck!

share|improve this answer

edited Mar 28 at 0:40

answered Mar 28 at 0:32

R0B0T-B0BAR0B0T-B0BA

4122 bronze badges

add a comment | 

Your Answer

StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54920363%2famazon-cloudwatch-logs-insights-parse-with-regex%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

4

Try another approach, like

parse @message /(?<@endpt>(/[a-zA-Z0-9_]+)1,)/
| stats count_distinct(@endpt) by @endpt

or, alternatively, consider the solution

fields @timestamp
| parse @message /(?<@endpt_post>POST (/[a-zA-Z0-9_]+)1,)/
| parse @message /(?<@endpt_get>GET (/[a-zA-Z0-9_]+)1,)/
| stats count() by @endpt_post, @endpt_get

Good luck!

share|improve this answer

edited Mar 28 at 0:40

answered Mar 28 at 0:32

R0B0T-B0BAR0B0T-B0BA

4122 bronze badges

add a comment | 

4

Try another approach, like

parse @message /(?<@endpt>(/[a-zA-Z0-9_]+)1,)/
| stats count_distinct(@endpt) by @endpt

or, alternatively, consider the solution

fields @timestamp
| parse @message /(?<@endpt_post>POST (/[a-zA-Z0-9_]+)1,)/
| parse @message /(?<@endpt_get>GET (/[a-zA-Z0-9_]+)1,)/
| stats count() by @endpt_post, @endpt_get

Good luck!

share|improve this answer

edited Mar 28 at 0:40

answered Mar 28 at 0:32

R0B0T-B0BAR0B0T-B0BA

4122 bronze badges

add a comment | 

Try another approach, like

parse @message /(?<@endpt>(/[a-zA-Z0-9_]+)1,)/
| stats count_distinct(@endpt) by @endpt

or, alternatively, consider the solution

fields @timestamp
| parse @message /(?<@endpt_post>POST (/[a-zA-Z0-9_]+)1,)/
| parse @message /(?<@endpt_get>GET (/[a-zA-Z0-9_]+)1,)/
| stats count() by @endpt_post, @endpt_get

Good luck!

share|improve this answer

edited Mar 28 at 0:40

answered Mar 28 at 0:32

R0B0T-B0BAR0B0T-B0BA

4122 bronze badges

parse @message /(?<@endpt>(/[a-zA-Z0-9_]+)1,)/
| stats count_distinct(@endpt) by @endpt

fields @timestamp
| parse @message /(?<@endpt_post>POST (/[a-zA-Z0-9_]+)1,)/
| parse @message /(?<@endpt_get>GET (/[a-zA-Z0-9_]+)1,)/
| stats count() by @endpt_post, @endpt_get

share|improve this answer

edited Mar 28 at 0:40

answered Mar 28 at 0:32

R0B0T-B0BAR0B0T-B0BA

4122 bronze badges

answered Mar 28 at 0:32

R0B0T-B0BAR0B0T-B0BA

4122 bronze badges

answered Mar 28 at 0:32

R0B0T-B0BAR0B0T-B0BA

4122 bronze badges