CloudWatch Logs Insights

gistfile1.txt

filter @message like '[INFO]'
| filter @message not like 'Found credentials in environment'
| fields @timestamp, @message, substr(@message, 0, 6) as msg_level, substr(@message, 7, 24) as msg_timestamp, substr(@message, 32, 33) as msg_uuid, substr(@message, 69) as msg_body
| parse msg_body '"event": "*"' as event_str
| parse msg_body '"event": {*}' as event_json
| parse event_json '"messageType": "*"' as messageType
| stats count(*) as qty by event_str, messageType
| sort qty desc