AWS AmazonCloudWatch documentation change

Service: AmazonCloudWatch · 2026-06-07 · Documentation medium

File: AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Parse.md

Summary

Added CSV parsing, JSON field extraction, and multi-match regex mode to parse command

Security assessment

Enhances log analysis capabilities which could indirectly support security monitoring, but doesn't address specific vulnerabilities. JSON extraction could help analyze security logs.

Diff

diff --git a/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Parse.md b/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Parse.md
index 02231777a..313a3f0c9 100644
--- a//AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Parse.md
+++ b//AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Parse.md
@@ -7 +7 @@
-Glob modeRegex modeLogfmt mode
+Glob modeRegex modeLogfmt modeCSV modeJSON field extraction
@@ -11 +11 @@ Glob modeRegex modeLogfmt mode
-Use `parse` to extract data from a log field and create extracted fields that you can process in your query. The `parse` command supports three modes: glob expressions, regular expressions, and logfmt.
+Use `parse` to extract data from a log field and create extracted fields that you can process in your query. The `parse` command supports four modes: glob expressions, regular expressions, logfmt, and CSV.
@@ -72,0 +73,17 @@ Use named capture groups `(?<`name`>...)` to define extracted fields.
+**Multi-match mode**
+
+Use multi-match mode to extract all matches of a regular expression from a field, producing multiple rows per log event. Add the keyword `multi` after the regex pattern.
+
+**Syntax**
+    
+    
+    parse fieldName /regex/ multi
+
+**Examples**
+
+**Extract all IP addresses from a log line (multi-match)**
+    
+    
+    parse @message /(\d+\.\d+\.\d+\.\d+)/ as ip_addr multi
+    | stats count(*) by ip_addr
+
@@ -94,0 +112,40 @@ The result is a map that you access with dot notation (for example, `lf.level`,
+## CSV mode
+
+Use `parse csv` to parse CSV-formatted log lines into structured fields. Each comma-separated value is assigned to the corresponding alias.
+
+**Syntax**
+    
+    
+    parse fieldName csv as alias1, alias2, alias3
+
+**Examples**
+    
+    
+    parse @message csv as timestamp, level, message
+    | filter level = "ERROR"
+    | display timestamp, message
+    
+    
+    parse @message csv as host, method, path, status, duration
+    | stats avg(duration) by method
+
+## JSON field extraction
+
+Use `json field=`fieldName`` for explicit chained JSON extraction from a previously parsed object field. This enables you to extract nested keys from a structured field without re-parsing the raw message.
+
+**Syntax**
+    
+    
+    json field=fieldName "key.subkey" as alias
+
+**Examples**
+    
+    
+    parse @message /(?<payload>\{.*\})/ as payload
+    | json field=payload "user.name" as username
+    | display username
+    
+    
+    json field=requestContext "identity.sourceIp" as caller_ip
+    | stats count(*) by caller_ip
+