CODEWITHSUNDEEP
regexamazon-web-servicesamazon-cloudwatch
turingMan
turingMan

Reputation: 167

Extract date from AWS Cloudwatch insights

I need to extract date_from and date_to from the following log field value. date_from=11-04-2020&date_to=01-04-2021&page_size=1000&page=1 in AWS cloudwatch

I have so far tried parse keyword with the following regex \d{2}-\d{2}-\d{4} and it does not work.

What I ultimately want to do is extract these two dates and gets the time difference between them in days.

Here's the query I tried,

filter @logStream like /<log-stream>/ and process like /rest-call/ | parse parameters '\d{2}-\d{2}-\d{4}' as @date | display @date

Upvotes: 2

Views: 6249

Answers (2)

turingMan
turingMan

Reputation: 167

For anyone looking AWS does not currently have any Date time functions to convert a date (i.e - mm/dd/yyyy) to a timestamp. Therefore, I exported the results of the above query to a CSV and did the timestamp calculations in Google Sheets.

Upvotes: 2

Wiktor Stribiżew
Wiktor Stribiżew

Reputation: 627082

You can capture both date_from and date_to into two named capturing groups:

parse parameters /date_from=(?<date_from>\d{2}-\d{2}-\d{4}).*?date_to=(?<date_to>\d{2}-\d{2}-\d{4})/ | display date_from, date_to

See the regex demo.

If the date format can be any, you may replace the \d{2}-\d{2}-\d{4} specific pattern with a more generic [^&]+:

/date_from=(?<date_from>[^&]+).*?date_to=(?<date_to>[^&]+)/

See the regex demo.

Note that .*? matches any zero or more chars other than line break chars, as few as possible (it is necessary to make sure the regex engine can "travel" all the way from the first capture to the second one as the regex engine parses the string from left to right and can never "skip" parts of a string, it should consume them).

Upvotes: 2

Related Questions