I have logs coming from AWS, first, I need to get just a message (which is an event) from the log  Second, in some logs, we have multiple messages inside log events, How I can just show logEvents{}.message and segregate the messages from the logs?  Sample log is { [-]     logEvents: [ [-]       { [-]         id: 123456789.....         message: {"Actual Log Event"}         timestamp: 1601177009988       }       { [-]      }     ]     logGroup: CloudTrail     logStream: 1234567890_CloudTrail_us-east-1     messageType: DATA_MESSAGE     owner:1234567890     subscriptionFilters: [ [-]    ]  } ... View more

I am using below query  index=aws earliest=-12h eventName=AuthorizeSecurityGroupIngress "items{}.cidrIp"="0.0.0.0/0" AND "items{}.port"!=8080 AND "items{}.port"!=22 AND "items{}.port"!=80 AND "items{}.port"!=443  to get data like if a user is making any changes and using the above-mentioned ports then it is not going to show the data and it is giving me the exact results but when I have a log that has nested ports then it is not giving me the actual result. eg items: []     {port: 12345}     {port: 22} It means if we have a nested log and it contains the above-mentioned ports then it should show the result. Any thoughts on this? ... View more