我有一个 lambda 函数,可以将指标写入Cloudwatch
。在写入指标的同时,它会在日志组中生成一些日志。
INFO:: username: [email protected] /cdn-cgi/l/email-protection ClinicID: 7667 nodename: MacBook-Pro-2.local
INFO:: username: [email protected] /cdn-cgi/l/email-protection ClinicID: 7669 nodename: MacBook-Pro-3.local
INFO:: username: [email protected] /cdn-cgi/l/email-protection ClinicID: 7668 nodename: MacBook-Pro-4.local
INFO:: username: [email protected] /cdn-cgi/l/email-protection ClinicID: 7667 nodename: MacBook-Pro-5.local
INFO:: username: si[email protected] /cdn-cgi/l/email-protection ClinicID: 7667 nodename: MacBook-Pro-2.local
我需要一种有效的方法来获得独特的价值观 of nodename
对于给定的ClinicId
。例如我传入7667
for ClinicId
我期望
['MacBook-Pro-2.local', 'MacBook-Pro-5.local']
这是我尝试过的:
query = "fields @timestamp, @message | parse @message \"username: * ClinicID: * nodename: *\" as username, ClinicID, nodename | filter ClinicID = "+ clinic_id
start_query_response = client.start_query(
logGroupName=log_group,
startTime=int(time.mktime((Util.utcnow() - timedelta(hours=hours)).timetuple())),
endTime=int(time.mktime(Util.utcnow().timetuple())),
queryString=query,
)
我考虑过迭代start_query_response
在Python中,但我不喜欢这个想法。由于它的日志超过7 days
我将要考虑的,我需要一种有效的方法,而不必迭代过去的每个日志7 days
对于给定的ClinicID
.