Stat operation on AWS Cloudwatch insight query to get field value from JSON Array

Viewed 363

I have below JSON in Cloudwatch logs, wanted to get the timestamp value of all the records in this.

"records": [
        {
            "timestamp": "2020-10-16T18:00:24Z",
            "temp": "-65.0",
            "temp1": 0,
            "temp2": -64
        },
        {
            "timestamp": "2020-10-16T19:00:24Z",
            "temp": "-65.0",
            "temp1": 0,
            "temp2": -64
        }
}

tried with the below queries, didn't help

fields @message
| parse @message '"records":[*]' as recordList
| parse recordList '{*}' as recordLine
| parse recordLine '"timestamp":"*"' as recordTime
| stat count() by recordTime 

This results in only the first record time in the query results, i need all the timestamp.

0 Answers
Related