AWS CloudWatch Log Insights：用replace替换Auth0日志事件类型编码

完全可以实现，CloudWatch Logs Insights支持通过replace()函数或者更易维护的case()语句完成编码到可读名称的映射，以下是两种可行方案：

方案一：使用嵌套replace()函数 #

适合映射关系较少的场景，通过多次嵌套replace()逐一替换编码：

fields @timestamp, detail.data.type
| eval event_type = replace(
    replace(
        replace(detail.data.type, "ssa", "Success Silent Auth"),
        "s", "Success Login"
    ),
    "fp", "Failed Login (Incorrect Password)"
)
| stats count(*) as occurrence_count by event_type
| rename event_type as "Event Type"
| sort occurrence_count desc

方案二：使用case()语句（推荐） #

当需要映射的编码较多时，case()语句结构更清晰，便于后续维护和扩展：

fields @timestamp, detail.data.type
| eval event_type = case(
    detail.data.type == "ssa", "Success Silent Auth",
    detail.data.type == "s", "Success Login",
    detail.data.type == "fp", "Failed Login (Incorrect Password)",
    detail.data.type == "seacft", "对应的可读名称", -- 根据实际需求添加更多映射
    true, detail.data.type -- 保留未匹配到的原始编码，避免丢失数据
)
| stats count(*) as occurrence_count by event_type
| rename event_type as "Event Type"
| sort occurrence_count desc

执行上述查询后，就能得到直观的统计结果，其中rename用于将字段名改为友好的"Event Type"，sort可按出现次数降序排列结果。

内容的提问来源于stack exchange，提问作者Lez