Is there any way to show another field that I don't want to stats by on cloudwatch logs

Viewed 68

I'm trying to write a query for our cloudwatch log insights so I can see more information based on errors. The query I wrote is this:

      FIELDS coalesce(error.message, err.message) as errorMessage,
             coalesce(error.type, err.type) as errorType
             level
             | FILTER @message like /(?i)(Exception|Error)/
             | stats count(*) as count by errorMessage, level, errorType

I want to include the @message on the output so I can see the stack trace too, but no matter what I try I can't get it to work. I can't seem to find anything on aws documenation, so is something like this possible?

The result I'm getting:

errorMessage, level, errorType, count

The result I'm trying to have

errorMessage, level, errorType, count, @message

I don't need each error message just one error message so I get the stack trace and the count too.

0 Answers
Related