Extract date from AWS Cloudwatch insights

user_14938081 0
Viewed 2309

I need to extract date_from and date_to from the following log field value. date_from=11-04-2020&date_to=01-04-2021&page_size=1000&page=1 in AWS cloudwatch

I have so far tried parse keyword with the following regex \d{2}-\d{2}-\d{4} and it does not work.

What I ultimately want to do is extract these two dates and gets the time difference between them in days.

Here's the query I tried,

filter @logStream like /<log-stream>/ and process like /rest-call/ | parse parameters '\d{2}-\d{2}-\d{4}' as @date | display @date

amazon-cloudwatch amazon-web-services regex
2 Answers

You can capture both date_from and date_to into two named capturing groups:

parse parameters /date_from=(?<date_from>\d{2}-\d{2}-\d{4}).*?date_to=(?<date_to>\d{2}-\d{2}-\d{4})/ | display date_from, date_to

See the regex demo.

If the date format can be any, you may replace the \d{2}-\d{2}-\d{4} specific pattern with a more generic [^&]+:

/date_from=(?<date_from>[^&]+).*?date_to=(?<date_to>[^&]+)/

See the regex demo.

Note that .*? matches any zero or more chars other than line break chars, as few as possible (it is necessary to make sure the regex engine can "travel" all the way from the first capture to the second one as the regex engine parses the string from left to right and can never "skip" parts of a string, it should consume them).

user_38329700

For anyone looking AWS does not currently have any Date time functions to convert a date (i.e - mm/dd/yyyy) to a timestamp. Therefore, I exported the results of the above query to a CSV and did the timestamp calculations in Google Sheets.

user_149380810
Related