Business
Jobs
  • About Us
  • Solutions
    • Job Postings
      Post your job and receive qualified candidates in 48h.
    • Candidate Assessments
      500+ technical and psychological tests, plus anti-fraud.
    • Headhunting
      Tailor-made executive search from start to finish.
    • Payroll + EOR
      Payroll dispersal and EOR across 15+ LATAM countries.
  • Pricing
  • Jobs

0

480
Views
Group By after parsing a message in AWS cloudwatch insights

I have messages which are like below, the following message is one of the messages (have so many JSON formats which are not at all related to this)

request body to the server {'sender': '65ddd20eac244AAe619383e4d8cb558834', 'message': 'hello'}

I would like to group of these messages based on sender (alphanumeric value) which is enclosed in JSON.

over 4 years ago · Santiago Trujillo
2 answers
Answer question

0

CloudWatch Logs Insights query:

fields @message |
filter @message like 'request body to the server' |
parse @message "'sender': '*', 'message'" as sender |
stats count(*) by sender

Query results:

-------------------------------------------------
|               sender               | count(*) |
|------------------------------------|----------|
| 65ddd20eac244AAe619383e4d8cb558834 |     4    |
| 55ddd20eac244AAe619383e4d8cb558834 |     3    |
-------------------------------------------------

Screenshot: enter image description here

over 4 years ago · Santiago Trujillo Report

0

you can use filter.

fields @timestamp, @message
| filter @message like "65ddd20eac244AAe619383e4d8cb558834"
| sort @timestamp desc
| limit 20

it will filter all the messages limit to 20 that send by 65ddd20eac244AAe619383e4d8cb558834.

update:

suppose the JSON log formate is this

{
    "sender": "65ddd20eac244AAe619383e4d8cb558835",
    "message": "Hi"
}

Now I want to count number of messages from 65ddd20eac244AAe619383e4d8cb558835

how many messages are coming from each user?

so simple you can run the query

stats count(sender) by sender |
# To filter only message the contain sender, to avoid lambda default logs
filter @message like "sender"

enter image description here if you want to see messages as well then modify the query a bit

stats count(*) by sender, message |

filter @message like "sender"

Here @message refers to whole to index where message refer to the JSON object message.

enter image description here

count_distinct

Returns the number of unique values for the field. If the field has very high cardinality (contains many unique values), the value returned by count_distinct is just an approximation.

how many distinct users in the selected interval?

It will list distinct users in 3hr of interval

 stats count_distinct(sender) as distinct_sender by bin(3hr) as interval

enter image description here

over 4 years ago · Santiago Trujillo Report
Answer question
Find remote jobs

Discover the new way to find a job!

Top jobs
Top job categories
Business
Post vacancy Pricing Sales
Legal
Terms and conditions Privacy policy
© 2026 PeakU Inc. All Rights Reserved.
Andres GPT
Show me some job opportunities
There's an error!