title: Amazon Cloudwatch Logs Insights with JSON fields
body: <p>I am trying to use Logs Insights with data containing JSON in one of the fields, and to parse the JSON fields</p>
  
  <p>My data looks like the following when I put it in insights with the starter code</p>
  
  <pre><code>fields @timestamp, @message
  | sort @timestamp desc
  | limit 25
  </code></pre>
  
  <p>How can I easily extract the <code>path</code> variable in my nested JSON to perform aggregations on it ? By looking at some documentation, I thought <code>@message.path</code> would work but it does not seem so. Has anyone successfully interpreted JSON logs in Insights</p>
  
  <p><a href="https://i.stack.imgur.com/3Duud.png" rel="noreferrer"><img src="https://i.stack.imgur.com/3Duud.png" alt="enter image description here"></a></p>
  
  <p>EDIT : Sample of what my data looks like</p>
  
  <pre><code>#
  @timestamp
  @message
  1
  2018-12-19 23:42:52.000
  I, [2018-12-19T23:42:52.629855 #23447] INFO -- : [2ce588f1-c27d-4a55-ac05-62a75b39e762] {"method":"GET","path":"/api/v1/professionals/ID","format":"json","controller":"API::V1::Public::ProfessionalsController","action":"show","status":200,"duration":285.27,"view":222.36,"time":"2018-12-19T23:42:52.344+00:00","params":{"include":"user,tags,promotions,company_sector,similar_professionals.tags,similar_professionals.user","format":"json","compress":false,"id":"ID"},"@timestamp":"2018-12-19T23:42:52.629Z","@version":"1","message":"[200] GET /api/v1/professionals/ID (API::V1::Public::ProfessionalsController#show)"}
  @logStream  i-05d1d61ab853517a0
  @message  I, [2018-12-19T23:42:52.629855 #23447] INFO -- : [2ce588f1-c27d-4a55-ac05-62a75b39e762] {"method":"GET","path":"/api/v1/professionals/ID","format":"json","controller":"API::V1::Public::ProfessionalsController","action":"show","status":200,"duration":285.27,"view":222.36,"time":"2018-12-19T23:42:52.344+00:00","params":{"include":"xxx","format":"json","compress":false,"id":"ID"},"@timestamp":"2018-12-19T23:42:52.629Z","@version":"1","message":"[200] GET /api/v1/professionals/ID (API::V1::Public::ProfessionalsController#show)"}
  @timestamp  1545262972000
  2
  2018-12-19 23:42:16.000
  I, [2018-12-19T23:42:16.723472 #851] INFO -- : [ea712503-eb86-4a6e-ab38-ddbcd6c2b4d0] {"method":"GET","path":"/api/v1/heartbeats/new","format":"json","controller":"API::V1::Public::HeartbeatsController","action":"new","status":201,"duration":9.97,"view":3.2,"time":"2018-12-19T23:42:16.712+00:00","params":{"format":"json","compress":false},"@timestamp":"2018-12-19T23:42:16.722Z","@version":"1","message":"[201] GET /api/v1/heartbeats/new (API::V1::Public::HeartbeatsController#new)"}
  </code></pre>