TylerBrock / saw

Fast, multi-purpose tool for AWS CloudWatch Logs
MIT License
1.4k stars 77 forks source link

Flag to print specific JSON key #39

Closed ccakes closed 1 year ago

ccakes commented 5 years ago

This adds a --key argument which allows printing only a partial JSON object. My use case is writing logs in JSON, but when using saw I tend to filter down to just what I want and so would rather just see ${event.message} rather than the whole JSON object

saw watch /logs/nomad --prefix my_app --filter "200 OK" --key message

I don't really "know" Go, so this PR is probably pretty terrible. There's certainly no error handling. Let me know if you'd accept this functionality and I'm happy to clean it up.

andrewpage commented 5 years ago

I think this functionality might be best left for another tool, like jq. I subscribe to the Unix philosophy of "do one thing and do it well" in this regard.

fquinner commented 5 years ago

Honestly I was looking for this functionality, then I saw this MR, I didn't actually realize JQ could handle newline delimited JSON (since it wasn't a JSON list) so never thought to try, but it does work.

saw watch --raw /aws/log/group/name | egrep "^{" | jq '.message'

I needed that first curly brace grep to get around some of the logging done by aws lambda that I have no control over the format of, and raw to trim out the metadata, but otherwise works well. If it's not added to the application, I think documenting an example like this in the README could prove useful.

TylerBrock commented 5 years ago

Thanks @ccakes! I do agree with @fquinner and @andrewpage that this "projection" work is best left to another tool like jq but i do see some value in providing a general projection ability in saw itself (if only for performance). I might need to think about this a bit more. I'll get back to you on it.