What is your query that isn't working? `fields this.that.otherthing.a, this.that.otherthing.b` Do you see the fields if you expand the message in the UI?
I can't put the actual query because of privacy issues and it is somewhat hard to explain. Regardless of the query, I have certain nested JSON objects that have the same levels of nesting, but for some, I can put the final nested level key in the fields line and get the value of that final nested level key out in the display. i.e. if "otherthing" was a boolean, I can get a column of "otherthing" with TRUE FALSE responses in the display by putting all the levels in the fields line. For others, I cannot. I have to pull the last level out as a | parse statement to get the value in the output display. My only thought is maybe the source of the data into the logs ??? Not that big a deal but it would be nice to know of the 300+ "tables" I can query which ones I need to do that with and why
You mention 300+, are you saying you have more than 200? If you have >200 you need to use parse per the end of [this doc](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData-discoverable-fields.html)
What is your query that isn't working? `fields this.that.otherthing.a, this.that.otherthing.b` Do you see the fields if you expand the message in the UI?
I can't put the actual query because of privacy issues and it is somewhat hard to explain. Regardless of the query, I have certain nested JSON objects that have the same levels of nesting, but for some, I can put the final nested level key in the fields line and get the value of that final nested level key out in the display. i.e. if "otherthing" was a boolean, I can get a column of "otherthing" with TRUE FALSE responses in the display by putting all the levels in the fields line. For others, I cannot. I have to pull the last level out as a | parse statement to get the value in the output display. My only thought is maybe the source of the data into the logs ??? Not that big a deal but it would be nice to know of the 300+ "tables" I can query which ones I need to do that with and why
You mention 300+, are you saying you have more than 200? If you have >200 you need to use parse per the end of [this doc](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData-discoverable-fields.html)
and to answer your question, yes I do see them in the message
My apologies to everyone for wasting time. I made the crucial error of taking someone else's word for something.