AWS Log Insights query with string contains - amazon-cloudwatch

Question

how do I query with contains string in AWS Log insights
fields #timestamp, #message
filter #message = "user not found"
| sort #timestamp desc
| limit 20
fields #timestamp, #message
filter #message strcontains("User not found")
| sort #timestamp desc
| limit 20

Answer 1

This should work fine
fields #timestamp, #message
| filter #message like /user not found/
| sort #timestamp desc
| limit 20

Answer 2

I think you need to select them as fields and then filter on their value. e.g:
fields #timestamp, #message, strcontains(#message, "user not found") AS unf
| filter unf=1
| sort #timestamp desc
| limit 20
Or use regex
fields #timestamp, #message
| filter #message like /User\snot\sfound/
| ...
(haven't tested them)

Answer 3

I recently ran into the same scenario. strcontains takes the input string as the first argument and the search value as the second. so in your case the following should work fine.
fields #timestamp, #message
| filter strcontains(#message, "User not found")
| sort #timestamp desc
| limit 20

Answer 4

I was looking for contains and in filters. Allowed filtering options are:
'in', 'and', 'or', 'not', 'like', '=~', '~=', '|', '|>', '^', '*', '/', '%', '+', '-', '<', '>', '<=', '>=', '=', '!='
So the solution using like seems also the optimal version in terms of operator.
fields #timestamp, #message
| filter #message like /user not found/
| sort #timestamp desc
| limit 20
Nevertheless there's another possibility to parse the message itself and do an equal comparison for use cases where one needs to be more exact. For formatted log rows like:
2020-12-24T19:08:18.180+01:00 [main] INFO com.foo.bar.FooBar - My log message!
You can parse substrings from the message and assign them to a field which can then be filtered using equal operator ("="). In the example below you can see no "INFO" String in the message can interfere with filtering severity:
fields #timestamp, #message
| parse #message "[*] * *" as #level, #severity, #info
| filter #logStream like "my/stream/within/loggroup"
| filter #severity="INFO"
| sort #timestamp desc
| limit 20