Direct JSON Field Access With CloudWatch Logs Insights

Did you know CloudWatch Logs Insights can automatically parse JSON in the @message field? It means you can directly access the properties of the JSON object without using dot notation! This makes writing queries much cleaner and more intuitive.

Let’s say your logs contain messages where @message is a JSON string like this:

{
  "level": "error",
  "status": 500,
  "error": "Internal Server Error",
  "other_data": "some_value"
}

And you want to filter for errors (sidenote: Notice that `level` works directly in the filter clause, even though it's a key inside the JSON stored in `@message`. You don't need to use `@message.level`.) . A query like this will work:

fields @timestamp, level, status, error, @logStream
| sort @timestamp desc
| filter level like 'error'
| limit 1000

The expected output would be: