I have below JSON in Cloudwatch logs, wanted to get the timestamp value of all the records in this.
"records": [
{
"timestamp": "2020-10-16T18:00:24Z",
"temp": "-65.0",
"temp1": 0,
"temp2": -64
},
{
"timestamp": "2020-10-16T19:00:24Z",
"temp": "-65.0",
"temp1": 0,
"temp2": -64
}
}
tried with the below queries, didn't help
fields @message
| parse @message '"records":[*]' as recordList
| parse recordList '{*}' as recordLine
| parse recordLine '"timestamp":"*"' as recordTime
| stat count() by recordTime
This results in only the first record time in the query results, i need all the timestamp.