filter JSON log events in CloudWatch with field dotted keys

Question

I'm trying to filter logs in CloudWatch that field key has dot inside.

For example, suppose we have the following JSON

{
    "trace.traceid": "18552fad59836133",
    "trace.spanid": "6eca8ae25f08605a",
    "peer.address": "111.111.111.222:4444",
    "eventType": "UpdateTrail",
    "sourceIPAddress": "111.111.111.111"
}

and I want to use the selector {$.peer.address="111.111.111.222:4444"} but the dot indicates field "address" inside object "peer" and not the flat key as described.

user_4631959 · Answer

The following syntax could possibly work:

"\"peer.address\": \"111.111.111.222:4444\""

It will search for the exact string. Please note that in this syntax spacing matters.

filter JSON log events in CloudWatch with field dotted keys

1 Answers