我在 AWS 云观察中有以下日志:
ENTITY=POSITION CONSUMER_ID=XXXX
ENTITY=POSITION CONSUMER_ID=XXXX
ENTITY=POSITION CONSUMER_ID=YYYY
ENTITY=POSITION CONSUMER_ID=YYYY
我想根据 CONSUMER_ID 对输出进行分组:
`CONSUMER_ID COUNT
XXXX 2
YYYY 2
我在 AWS cloudwatch insights 中解析消息后参考 Group By 后尝试以下查询 .但没有给出所需的输出:
fields @message | filter @message like 'ENTITY=POSITION ' | parse @message "'CONSUMER_ID=''*'" as CONSUMER_ID | stats count(*) by CONSUMER_ID
期待:
`CONSUMER_ID COUNT
XXXX 2
YYYY 2
`