display - Amazon CloudWatch Logs

display

Use display to show a specific field or fields in query results.

The display command shows only the fields you specify. If your query contains multiple display commands, the query results show only the field or fields that you specified in the final display command.

Example: Display one field

The code snippet shows an example of a query that uses the parse command to extract data from @message to create the extracted fields loggingType and loggingMessage. The query returns all log events where the values for loggingType are ERROR. display shows only the values for loggingMessage in the query results.

fields @message | parse @message "[*] *" as loggingType, loggingMessage | filter loggingType = "ERROR" | display loggingMessage
Tip

Use display only once in a query. If you use display more than once in a query, the query results show the field specified in the last occurrence of display command being used.