AWS Cloudwatch Logs Insights：查询数组

Question

我有一个包含此类消息的日志组。

{
  "m": [
    {
      "id": "5b6973c7c86e8689368b4569",
      "ts": 1634112000.062
    },
        {
      "id": "6116d21e02e38f5045079c42",
      "ts": 1634120807.402
    },
    {
      "id": "60c368ff1085fc0d546fad52",
      "ts": 1634120807.512
    },
    {
      "id": "6053536817a46610797ed472",
      "ts": 1634120809.249
    }
  ]
}

我想对字段 m.*.ts （它是一个数组）运行查询。像这样的东西...

fields @message
| filter (m.*.ts > 1634112000.062 and m.*.ts < 1634120807.000 )

有可能吗？

Answer 1

fields @message
  | parse @message "[*] *" as id, ts
  | filter (ts > 1634112000.062 and ts <  1634120807.000)