How to filter CloudWatch Log Insights with ispresent() function
After a while, I figured out how to do that, in a hackish way.
fields @timestamp, status, ispresent(status) as exist
| filter exist != 0
Not the best way (and it goes against their documentation), but works.
The accepted answer doesn't work for me, but you can now negate ispresent()
:
fields @timestamp, status
| filter !ispresent(status)