13
votes

I'm trying to perform a really simple query on the not so new AWS Cloudwatch Log Insights

I'm following their documentation to filter my logs using ispresent function.

The query is the following:

fields @timestamp, status
| filter ispresent(status) != 0

But this give me an error (the super unhelpful We are having trouble understanding the query)

How can I filter my logs by showing only the logs with the status field?

2

2 Answers

15
votes

After a while, I figured out how to do that, in a hackish way.

fields @timestamp, status, ispresent(status) as exist
| filter exist != 0

Not the best way (and it goes against their documentation), but works.

10
votes

The accepted answer doesn't work for me, but you can now negate ispresent() now:

fields @timestamp, status
| filter !ispresent(status)