CloudWatch

sort @timestamp desc
| filter @message like /Successfully sent patch to videoApi/
| parse @message /(?<assetId>eurosport-\S+)/

------------------
parse '<contentId>*</contentId>' as AssetId
| sort @timestamp desc
| filter @message like /contentId/
| stats count(*) by AssetId

--------------------
parse message.response.body '"corporateId":"*",*,"header":"*"' as corporateId, split1, header
| display corporateId, header, message.response.body
| filter message.response.statusCode like /200/
| filter @message like /Entrepreneur individuel/
| sort @timestamp desc
| dedup corporateId 
---------------------
// Other Examples: 
parse '\"resourceId\":\"*\"' as PlayoutId

------------------
sort @timestamp desc
| limit 10000
| filter log_level = "error" and message.message like /Too Many Requests/
| stats count(@requestId) as counter by @requestId

------------------
fields @timestamp, @message, @logStream
| sort @timestamp desc
| filter @message like /Invoke Error/
| filter @message like /Task/