'How to extract all matches as array by parsing a JSON message using AWS CloudWatch Logs Insights?

I log messages that are JSON objects. The JSON has an array that contains objects with id:

{
   ...
   "arr": [{"typeId": 1, "foo": "bar"}, {"typeId": 10, "foo": "other"}, ...],
   ...
}

Now I want to count usage of objects by type by counting all occurrences of their corresponding ID in the array.

I've tried the following query:

filter @message like '"typeId":'
| parse @message '"typeId":*,' as id
| stats count(id) as objCount by id
| sort objCount desc

Which produces a result:

id objCount
113 28
1 12
296 10
2 9

But it looks wrong. It seems to extract only the very first ID value from each message. I know it because if I search logs by filter @message like '"typeId":113,' I get 44 occurrences.

How can I extract all matches by using parse?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source