什么是相当于 SQL 的“WHERE IN ('foo', 'bar')”的 cloudwatch 洞察日志答案

【问题标题】：What is the cloudwatch insights logs equivalent of SQL's "WHERE IN ('foo', 'bar')"什么是相当于 SQL 的“WHERE IN ('foo', 'bar')”的 cloudwatch 洞察日志
【发布时间】：2021-03-22 23:19:14
【问题描述】：

这是无效的：

fields @timestamp, log
| sort @timestamp desc
| filter kubernetes.pod_name like /my-pod/
| filter log.someId IN (156446, 156447, 156448, 156449, 156450, 156451, 156453, 156454, 156455, 156456, 156457, 156458, 156459, 156460, 156461, 156462, 154832, 154379, 154380, 154381, 154382, 153597, 145666, 145647, 145627, 139961, 139967, 142303, 142597, 130045, 129441, 131003, 123103, 122227, 122294 )

最后一部分不正确。实现此目的的正确方法是什么？

【问题讨论】：

标签： amazon-cloudwatch amazon-cloudwatchlogs aws-cloudwatch-log-insights

【解决方案1】：

想通了。只需使用[] 而不是()。所以：

fields @timestamp, log
| sort @timestamp desc
| filter kubernetes.pod_name like /my-pod/
| filter log.someId IN [156446, 156447, 156448, 156449, 156450, 156451, 156453, 156454, 156455, 156456, 156457, 156458, 156459, 156460, 156461, 156462, 154832, 154379, 154380, 154381, 154382, 153597, 145666, 145647, 145627, 139961, 139967, 142303, 142597, 130045, 129441, 131003, 123103, 122227, 122294]

【讨论】：