This is my sample Logs from Cloudwatch logs:
[INFO] 2025-04-30T17:42:26.635Z cf79fc56-849b-4577-b253-72f94d1f8fa7 Decoded events:
[
{
"event_type": "_SMS.BUFFERED",
"event_timestamp": 1746034940084,
"arrival_timestamp": 1746034940711,
"event_version": "3.1",
"application": {
"app_id": "a5f5282f2879453887ffd0381fcba2e9",
"sdk": {}
},
"client": {
"client_id": "kof8f2ky9ahjtinyvtbrsftygom"
},
"device": {
"platform": {}
},
"session": {},
"attributes": {
"sender_request_id": "lodreco6ffaasq2j51nbfi33l2hal530o601l4g0",
"destination_phone_number": "+15197918331",
"record_status": "SUCCESSFUL",
"iso_country_code": "CA",
"mcc_mnc": "302720",
"number_of_message_parts": "2",
"message_id": "lodreco6ffaasq2j51nbfi33l2hal530o601l4g0",
"message_type": "Transactional",
"origination_phone_number": "+13435013190"
},
"metrics": {
"price_in_millicents_usd": 2696.0
},
"awsAccountId": "971422684164"
},
{
"event_type": "_SMS.BUFFERED",
"event_timestamp": 1746034940357,
"arrival_timestamp": 1746034940996,
"event_version": "3.1",
"application": {
"app_id": "a5f5282f2879453887ffd0381fcba2e9",
"sdk": {}
},
"client": {
"client_id": "u4m+htrfzep84of7dbi/8msma2e"
},
"device": {
"platform": {}
},
"session": {},
"attributes": {
"sender_request_id": "le2g8i291bmkam9u978l8iv05cgig7igrme0dho0",
"destination_phone_number": "+15819846395",
"record_status": "SUCCESSFUL",
"iso_country_code": "CA",
"mcc_mnc": "302500",
"number_of_message_parts": "2",
"message_id": "le2g8i291bmkam9u978l8iv05cgig7igrme0dho0",
"message_type": "Transactional",
"origination_phone_number": "+13435013190"
},
"metrics": {
"price_in_millicents_usd": 2696.0
},
"awsAccountId": "971422684164"
}
]
I am trying the below Query, but it is showing the "Final Column as Blank :
SELECT
logevent.message,
regexp_extract(logevent.message, '(Decoded events:[ \t]*:[ \t]*)') AS "FINAL",
SUBSTRING(logevent.message, STRPOS(logevent.message, '{')) AS "json_array",
*FROM "AwsDataCatalog"."beautifi-logs-printsmstext-database"."beautifi_logs_printsmsevents"
CROSS JOIN UNNEST(logevents) AS t (logevent)
WHERE logevent.message LIKE '%Decoded events:%'
Can anyone help me here ?