结合两个 Cloudwatch 洞察查询

Question

我有两个 Cloudwatch 见解查询，我希望能够并行运行并比较两者的结果。

stats count(*) as requestIdCount by @requestId 
| filter @message like /START RequestId/
| filter requestIdCount > 1

stats count(*) as requestIdCount by @requestId 
| filter @message like /END RequestId/
| filter requestIdCount > 1

能够做到这一点会很棒

fields (
    stats count(*) as requestIdCount by @requestId 
    | filter @message like /END RequestId/
    | filter requestIdCount > 1) as EndRequestCount,
       (
    stats count(*) as requestIdCount by @requestId 
    | filter @message like /START RequestId/
    | filter requestIdCount > 1) as StartRequestCount 

但是我现在看不到任何方法可以在见解中进行子查询。有没有一种方法可以组合这样的查询？

Answer 1

尝试这个：

parse @message 'START RequestId' as @startRequestId
    | parse @message 'END RequestId' as @endRequestId
    | stats count(@startRequestId) as startRequestIdCount , count(@endRequestId) as endRequestIdCount by bin(5m)
    | filter startRequestIdCount > 1
    | filter endRequestIdCount > 1

CloudWatch Logs Insights 查询语法