Flatten the JSON array items in cloudwatch

481 Views Asked by At

I have the following message logged to cloudwatch and I am trying to flatten it in the CloudWatch insights

{
    "LogReferenceId": "36a86fd4-1ecd-4e1e-8cf5-d6179240ffc8",
    "ApplicationName": "User",
    "UriResourceName": "/UserController/Add",
    "Messages": [
        {
            "Message": "Started",
            "TimeStamp": "2020-12-10T09:58:14.3042143Z"
        },
        
        {
            "Message": "Adding tracking information",
            "TimeStamp": "2020-12-10T09:58:14.3661264Z"
        },
        {
            "Message": "compltedCompleted",
            "TimeStamp": "2020-12-10T09:58:14.4015502Z"
        }
    ],
    "Exception": null,
    "Status": "Success"
}

I ma new to Insights and the documentation from AWS is not that helpful for me.

I something like this but it does not work

fields @timestamp 
| parse @message '"Messages":[*]' as all
| parse all '"Message":"*"' as Messas
0

There are 0 best solutions below