CloudWatch Logs Insights: converting strings to timestamp or datetime values

Viewed 93

I have log events in CloudWatch whcih have certain fields like @timestamp and @message.

@timestamp looks like this:

2022-08-09T08:49:51.971+02:00

and @message like this:

2022-08-09 06:49:49.376 INFO [xyz, 123abc456] xxxxxxx

I can extract the time in @message by using something like this:

| parse @message /(?<messagetst>.+) INFO/ 

What I want to do is to

  1. convert the timestamp of @timestamp to UTC and a datetime format,
  2. convert the @message messagetst to a datetime format,
  3. substract @timestamp from messagetst.

Is this possible in CloudWatch and how can I do this?

0 Answers
Related