20

Attempting to use a built-in Cloudwatch Log function like "date_floor" with a 8601 timestamp string like "2020-03-24T19:03:34.645Z" gives back an "Invalid date" error in Cloudwatch Log Insights.

Does anyone know what is required to parse/cast timestamps that appear within your logs so they can be used with the built-in date/time functions?

My end goal is to compare a timestamp that appears within my logs with the built-in @ingestionTime field.

scolestock
  • 717
  • 6
  • 17
  • 7
    Unbelievable that Cloudwatch has ZERO support for basic/standard date string parsing. No replies on this post as of today. No solution here: https://www.reddit.com/r/aws/comments/g18d5q/cloudwatch_insights_parse_string_to_date/ Generally very difficult to use: https://www.reddit.com/r/devops/comments/8n3fpz/is_cloudwatch_logs_really_terrible_or_am_i_just/dzsz8qg/?utm_source=reddit&utm_medium=web2x&context=3 – Triynko Sep 12 '20 at 18:37
  • 1
    I'm back. It's been a year. Still no solution. In addition, we can't parse milliseconds anymore, because positive lookback is now broken for a line like: `parse time /(?(?<=[.])[0-9]{3})/`. Matches nothing. Used to work. No longer works. – Triynko Nov 03 '21 at 18:26
  • On the ms note, I rely on `(?[0-9]+)\.[0-9]*?\s+ms` to get only the integer part of something that looks like this `10629.644 ms` which is Postgresql slow query log format. – Arjuna Del Toso Dec 02 '21 at 23:01

0 Answers0