title: Parsing JSON with CloudWatch Insight Logs
body: <p>I am having difficulty in parsing my JSON to <strong>only</strong> show the ingestId of my messages. My JSON file that is uploaded to CloudWatch is like so:</p>
  <pre><code>{
      &quot;message&quot;: &quot;changeStatus ingestId=2343d8sf-etc, 
               status=UPLOADING&quot;,
      &quot;level&quot;: &quot;info&quot;
  }
  </code></pre>
  <p>My CloudWatch Log Insight code is like so:</p>
  <pre><code>filter level = &quot;error&quot;
  | filter @message like /([-\w]{25,})/
  | filter strcontains(@logStream, 'ingest-')
  | fields @timestamp, @message, @logStream, level
  | sort @logStream, @timestamp asc
  </code></pre>
  <p>Insight produces a new column with no information of the ID I would want. What am I doing wrong so I can at least the the ID of the ingest?</p>
  <p>Would appreciate any help.</p>
  <p>EDIT (v2):
  I was able to find the regex needed to get the Ingest ID with this regex code:</p>
  <pre><code>/([-\w]{25,})/
  </code></pre>
  <p>Here is the code. It successfully runs with a new column of ingestId but still no ingest ID that I am looking for:</p>
  <p><a href="https://i.stack.imgur.com/of1sV.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/of1sV.png" alt="enter image description here" /></a></p>
  <pre><code>filter level = &quot;error&quot;
  | filter strcontains(@logStream, 'ingest-')
  | filter @message like /(ingestId)/
  | parse @message &quot;\&quot;ingestId\&quot;: \&quot;/([-\w]{25,})/\&quot;&quot; as ingestId
  | fields @timestamp, @message, @logStream, level
  | sort @logStream, @timestamp asc
  </code></pre>
  <p>What can be done so I can display the ingest Id of each message coming in? Thanks all.</p>