How filter Cloudwatch Logs Aws?

[angelicamaria (Angélica Maria)]

Hello guys,

How do I make the filter take into account the records that are between START and END?

I want to send to Elastic something as this:
{
"_index": "pruebalog:07132017",
"_type": "cloudwatch_logs",
"_id": "23334844787867677",
"_score": null,
"_source": {
"hostName": "AWS LOGS",
"appName": "LAMBDA",
"priority": "ERROR",
"@timestamp": "2019-03-25T15:50:55.000Z",
"message": {
"data": "{
Console Log #0
Console Log #1
Console Log #2
...
...
...
}
}
},
"fields": {
"@timestamp": [
12333333333333
]
}
}

[Badger]

What do you want the result to be?

[angelicamaria (Angélica Maria)]

Friend, update the question, thanks for the help.

[Badger]

That looks like a very good match for Example 1 given in the documentation of the aggregate filter. You have a start event, and end event, and every line has a guid that can be used to correlate them.