Question

Current query :
fields  @message
| filter @message like /ABCD/
| stats count(@message)

结果：@messages 1 55 现在需要在此查询中添加更多内容，例如过滤器，如/ BCDE /，/ EFGH /，/ IJKL / ..... 预期的结果应该像 @ABCD @BCDE @EFGH @IJKL ... 55 66 77 88。

可以得到这样的吗？所有搜索关键字都必须在整个CloudWatch日志中进行搜索。

Answer 1

这应该对您有用：

fields  @message
| filter @message like /ABCD|BCDE|EFGH|IJKL/ 
| fields strcontains(@message, "ABCD") as @CONTAINS_ABCD,
         strcontains(@message, "BCDE") as @CONTAINS_BCDE,
         strcontains(@message, "EFGH") as @CONTAINS_EFGH,
         strcontains(@message, "IJKL") as @CONTAINS_IJKL
| stats sum(@CONTAINS_ABCD) as @ABCD, 
        sum(@CONTAINS_BCDE) as @BCDE, 
        sum(@CONTAINS_EFGH) as @EFGH, 
        sum(@CONTAINS_IJKL) as @IJKL

Cloudwatch见解查询修改

1 个答案: