Cloudwatch Log Insights syntax for parsing everything before first forward slash

user_3469521 0
Viewed 1125

I have a JSON Cloudwatch log as below:

{"path": "folder1/folder2/file.txt"}

My aim is to parse this log so that I can create a new field parent from the path field such that its value is folder1. I basically need to get everything from the beginning till the first forward slash in the path field value.

This is what I am trying:

fields  @timestamp, @message
| parse @message '"path": "*"' as @path
| parse @path /(^[^\/]+)/ as @parent

But it is giving me a syntax error on as on line 3 with the error: 'as' is not valid in this position, expecting EOF, '|', '|>'

I tested the regex expression that I am using at https://rubular.com/r/CXQS8auGY08K0M.

What am I missing? Thanks!

aws-cloudwatch-log-insights amazon-cloudwatch amazon-cloudwatchlogs
2 Answers

When using the parse command with a regular expression, use named capturing group syntax instead of field aliasing:

parse @path /(?<parent>^\w+)/
user_10795100

As the message starts and ends with {}, you need to add them to the parsing regex. The following should help

fields  @timestamp, @message
| parse @message '{"path": "*"}' as @path
| parse @path '*/*' as @parent, @subfolder
user_46011200
Related