I am trying to use Logs Insights with data containing JSON in one of the fields, and to parse the JSON fields

My data looks like the following when I put it in insights with the starter code

    fields @timestamp, @message
    | sort @timestamp desc
    | limit 25

How can I easily extract the `path` variable in my nested JSON to perform aggregations on it ? By looking at some documentation, I thought `@message.path` would work but it does not seem so. Has anyone successfully interpreted JSON logs in Insights

[![enter image description here][1]][1]

EDIT : Sample of what my data looks like

    #
    @timestamp
    @message
    1
    2018-12-19 23:42:52.000
    I, [2018-12-19T23:42:52.629855 #23447] INFO -- : [2ce588f1-c27d-4a55-ac05-62a75b39e762] {&quot;method&quot;:&quot;GET&quot;,&quot;path&quot;:&quot;/api/v1/professionals/ID&quot;,&quot;format&quot;:&quot;json&quot;,&quot;controller&quot;:&quot;API::V1::Public::ProfessionalsController&quot;,&quot;action&quot;:&quot;show&quot;,&quot;status&quot;:200,&quot;duration&quot;:285.27,&quot;view&quot;:222.36,&quot;time&quot;:&quot;2018-12-19T23:42:52.344+00:00&quot;,&quot;params&quot;:{&quot;include&quot;:&quot;user,tags,promotions,company_sector,similar_professionals.tags,similar_professionals.user&quot;,&quot;format&quot;:&quot;json&quot;,&quot;compress&quot;:false,&quot;id&quot;:&quot;ID&quot;},&quot;@timestamp&quot;:&quot;2018-12-19T23:42:52.629Z&quot;,&quot;@version&quot;:&quot;1&quot;,&quot;message&quot;:&quot;[200] GET /api/v1/professionals/ID (API::V1::Public::ProfessionalsController#show)&quot;}
    @logStream  i-05d1d61ab853517a0
    @message  I, [2018-12-19T23:42:52.629855 #23447] INFO -- : [2ce588f1-c27d-4a55-ac05-62a75b39e762] {&quot;method&quot;:&quot;GET&quot;,&quot;path&quot;:&quot;/api/v1/professionals/ID&quot;,&quot;format&quot;:&quot;json&quot;,&quot;controller&quot;:&quot;API::V1::Public::ProfessionalsController&quot;,&quot;action&quot;:&quot;show&quot;,&quot;status&quot;:200,&quot;duration&quot;:285.27,&quot;view&quot;:222.36,&quot;time&quot;:&quot;2018-12-19T23:42:52.344+00:00&quot;,&quot;params&quot;:{&quot;include&quot;:&quot;xxx&quot;,&quot;format&quot;:&quot;json&quot;,&quot;compress&quot;:false,&quot;id&quot;:&quot;ID&quot;},&quot;@timestamp&quot;:&quot;2018-12-19T23:42:52.629Z&quot;,&quot;@version&quot;:&quot;1&quot;,&quot;message&quot;:&quot;[200] GET /api/v1/professionals/ID (API::V1::Public::ProfessionalsController#show)&quot;}
    @timestamp  1545262972000
    2
    2018-12-19 23:42:16.000
    I, [2018-12-19T23:42:16.723472 #851] INFO -- : [ea712503-eb86-4a6e-ab38-ddbcd6c2b4d0] {&quot;method&quot;:&quot;GET&quot;,&quot;path&quot;:&quot;/api/v1/heartbeats/new&quot;,&quot;format&quot;:&quot;json&quot;,&quot;controller&quot;:&quot;API::V1::Public::HeartbeatsController&quot;,&quot;action&quot;:&quot;new&quot;,&quot;status&quot;:201,&quot;duration&quot;:9.97,&quot;view&quot;:3.2,&quot;time&quot;:&quot;2018-12-19T23:42:16.712+00:00&quot;,&quot;params&quot;:{&quot;format&quot;:&quot;json&quot;,&quot;compress&quot;:false},&quot;@timestamp&quot;:&quot;2018-12-19T23:42:16.722Z&quot;,&quot;@version&quot;:&quot;1&quot;,&quot;message&quot;:&quot;[201] GET /api/v1/heartbeats/new (API::V1::Public::HeartbeatsController#new)&quot;}



  [1]: https://i.stack.imgur.com/3Duud.png

All Amazon Cloudwatchlogs Solutions on Gang of Coders

Total of 1 Amazon Cloudwatchlogs Solutions

Amazon Cloudwatch Logs Insights with JSON fields