名称中包含连字符的 AWS CloudWatch Insights 查询字段

Question

尝试运行包含reqHeaders.x-forwarded-for的 CloudWatch Insights 查询，例如

fields @timestamp, status, err, method, url, req_id, reqHeaders.x-forwarded-for
| filter status >= 400
| sort @timestamp desc
| limit 10

但是这个字段总是空的，尽管它在@message中被正确解析了。我怀疑这是因为子字段名称中的连字符。有没有人知道如何重新格式化查询以使其显示？

编辑：这是一个日志消息示例(纯JSON，我刚刚格式化了它(

{
"cache": null,
"client": "172.31.10.31",
"component": "server",
"err": "Invalid access token",
"hostname": "0da665ab5653",
"level": 30,
"method": "PUT",
"msg": "REQ: 401 PUT /api/xxxxxxxxxx",
"name": "rocket",
"pid": 10,
"reqHeaders": {
"accept-encoding": "gzip",
"cloudfront-forwarded-proto": "https",
"cloudfront-is-desktop-viewer": "true",
"cloudfront-is-mobile-viewer": "false",
"cloudfront-is-smarttv-viewer": "false",
"cloudfront-is-tablet-viewer": "false",
"cloudfront-viewer-country": "XX",
"content-length": "74",
"content-type": "application/json; charset=UTF-8",
"host": "xxxxxxxxxx",
"user-agent": "okhttp/3.10.0",
"via": "2.0 28b8fcaccf73021230d8e4a6c3d9e81e.cloudfront.net (CloudFront)",
"x-amz-cf-id": "UqaCCZL9XDze9baJM5dq1fexhqaX9_Qurg2i88A3m-pfrK68Bx93mg==",
"x-amzn-trace-id": "Root=1-5de37d7b-9e9d1ee0ad828a4e316b4f5c",
"x-forwarded-for": "70.31.103.92, 64.252.147.153",
"x-forwarded-port": "443",
"x-forwarded-proto": "https",
"x-newrelic-id": "VgYOV1RaDRADU1RUBwgFUVA=",
"x-request-id": "Root=1-5de37d7b-9e9d1ee0ad828a4e316b4f5c"
},
"reqTime": "2019-12-01T08:44:43.955Z",
"req_id": "Root=1-5de37d7b-9e9d1ee0ad828a4e316b4f5c",
"resMs": 1,
"route": "/api/xxxxxxxxxx",
"routeName": "putapixxxxxxxxxx",
"status": 401,
"time": "2019-12-01T08:44:43.956Z",
"url": "/api/xxxxxxxxxx",
"v": 0
}

Answer 1

把它放在一个反勾号之间：`

fields @timestamp, status, err, method, url, req_id, `x-forwarded-for`

Answer 2

自己找到的

fields @timestamp, status, err, method, url, req_id
| parse @message '"x-forwarded-for":"*"' as ip
| filter status >= 400
| sort @timestamp desc
| limit 10