where - Amazon CloudWatch Logs
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

where

Use the where command as an alias for the filter command. It accepts identical syntax and behavior.

Syntax

| where condition

The command uses the following arguments:

  • condition – A boolean expression identical to what the filter command accepts.

Example

The following query filters for log events containing "error".

fields @timestamp, @message
| where @message like /error/