名称中带有连字符的 AWS CloudWatch Insights 查询字段
AWS CloudWatch Insights query field with hyphen in name
正在尝试 运行 包含 reqHeaders.x-forwarded-for
的 CloudWatch Insights 查询,如
fields @timestamp, status, err, method, url, req_id, reqHeaders.x-forwarded-for
| filter status >= 400
| sort @timestamp desc
| limit 10
但此字段始终为空,尽管它已在 @message
中正确解析。我怀疑这是因为子字段名称中的连字符。有人知道如何重新格式化查询以显示它吗?
编辑:这是一个日志消息示例(纯 JSON,我刚刚格式化)
{
"cache": null,
"client": "172.31.10.31",
"component": "server",
"err": "Invalid access token",
"hostname": "0da665ab5653",
"level": 30,
"method": "PUT",
"msg": "REQ: 401 PUT /api/xxxxxxxxxx",
"name": "rocket",
"pid": 10,
"reqHeaders": {
"accept-encoding": "gzip",
"cloudfront-forwarded-proto": "https",
"cloudfront-is-desktop-viewer": "true",
"cloudfront-is-mobile-viewer": "false",
"cloudfront-is-smarttv-viewer": "false",
"cloudfront-is-tablet-viewer": "false",
"cloudfront-viewer-country": "XX",
"content-length": "74",
"content-type": "application/json; charset=UTF-8",
"host": "xxxxxxxxxx",
"user-agent": "okhttp/3.10.0",
"via": "2.0 28b8fcaccf73021230d8e4a6c3d9e81e.cloudfront.net (CloudFront)",
"x-amz-cf-id": "UqaCCZL9XDze9baJM5dq1fexhqaX9_Qurg2i88A3m-pfrK68Bx93mg==",
"x-amzn-trace-id": "Root=1-5de37d7b-9e9d1ee0ad828a4e316b4f5c",
"x-forwarded-for": "70.31.103.92, 64.252.147.153",
"x-forwarded-port": "443",
"x-forwarded-proto": "https",
"x-newrelic-id": "VgYOV1RaDRADU1RUBwgFUVA=",
"x-request-id": "Root=1-5de37d7b-9e9d1ee0ad828a4e316b4f5c"
},
"reqTime": "2019-12-01T08:44:43.955Z",
"req_id": "Root=1-5de37d7b-9e9d1ee0ad828a4e316b4f5c",
"resMs": 1,
"route": "/api/xxxxxxxxxx",
"routeName": "putapixxxxxxxxxx",
"status": 401,
"time": "2019-12-01T08:44:43.956Z",
"url": "/api/xxxxxxxxxx",
"v": 0
}
自己找的
fields @timestamp, status, err, method, url, req_id
| parse @message '"x-forwarded-for":"*"' as ip
| filter status >= 400
| sort @timestamp desc
| limit 10
放在“`”之间
fields @timestamp, status, err, method, url, req_id, `x-forwarded-for`
正在尝试 运行 包含 reqHeaders.x-forwarded-for
的 CloudWatch Insights 查询,如
fields @timestamp, status, err, method, url, req_id, reqHeaders.x-forwarded-for
| filter status >= 400
| sort @timestamp desc
| limit 10
但此字段始终为空,尽管它已在 @message
中正确解析。我怀疑这是因为子字段名称中的连字符。有人知道如何重新格式化查询以显示它吗?
编辑:这是一个日志消息示例(纯 JSON,我刚刚格式化)
{
"cache": null,
"client": "172.31.10.31",
"component": "server",
"err": "Invalid access token",
"hostname": "0da665ab5653",
"level": 30,
"method": "PUT",
"msg": "REQ: 401 PUT /api/xxxxxxxxxx",
"name": "rocket",
"pid": 10,
"reqHeaders": {
"accept-encoding": "gzip",
"cloudfront-forwarded-proto": "https",
"cloudfront-is-desktop-viewer": "true",
"cloudfront-is-mobile-viewer": "false",
"cloudfront-is-smarttv-viewer": "false",
"cloudfront-is-tablet-viewer": "false",
"cloudfront-viewer-country": "XX",
"content-length": "74",
"content-type": "application/json; charset=UTF-8",
"host": "xxxxxxxxxx",
"user-agent": "okhttp/3.10.0",
"via": "2.0 28b8fcaccf73021230d8e4a6c3d9e81e.cloudfront.net (CloudFront)",
"x-amz-cf-id": "UqaCCZL9XDze9baJM5dq1fexhqaX9_Qurg2i88A3m-pfrK68Bx93mg==",
"x-amzn-trace-id": "Root=1-5de37d7b-9e9d1ee0ad828a4e316b4f5c",
"x-forwarded-for": "70.31.103.92, 64.252.147.153",
"x-forwarded-port": "443",
"x-forwarded-proto": "https",
"x-newrelic-id": "VgYOV1RaDRADU1RUBwgFUVA=",
"x-request-id": "Root=1-5de37d7b-9e9d1ee0ad828a4e316b4f5c"
},
"reqTime": "2019-12-01T08:44:43.955Z",
"req_id": "Root=1-5de37d7b-9e9d1ee0ad828a4e316b4f5c",
"resMs": 1,
"route": "/api/xxxxxxxxxx",
"routeName": "putapixxxxxxxxxx",
"status": 401,
"time": "2019-12-01T08:44:43.956Z",
"url": "/api/xxxxxxxxxx",
"v": 0
}
自己找的
fields @timestamp, status, err, method, url, req_id
| parse @message '"x-forwarded-for":"*"' as ip
| filter status >= 400
| sort @timestamp desc
| limit 10
放在“`”之间
fields @timestamp, status, err, method, url, req_id, `x-forwarded-for`