I have log events in CloudWatch whcih have certain fields like @timestamp and @message.
@timestamp looks like this:
2022-08-09T08:49:51.971+02:00
and @message like this:
2022-08-09 06:49:49.376 INFO [xyz, 123abc456] xxxxxxx
I can extract the time in @message by using something like this:
| parse @message /(?<messagetst>.+) INFO/
What I want to do is to
- convert the timestamp of
@timestampto UTC and a datetime format, - convert the
@messagemessagetstto a datetime format, - substract
@timestampfrommessagetst.
Is this possible in CloudWatch and how can I do this?