An example of how to use regex in the parse statement of a CloudWatch Insights query

cwl_insights_parse_regex.sh

#!/usr/bin/env bash

query_string=$(cat << EndOfMessage 
fields @timestamp, @logStream, headers.X-Amzn-Trace-Id, @transId, @message 
| parse @message /(transactionId:[ ]?)(?<@transId>[a-zA-Z0-9]+)/ 
| filter @transId = a4c475516be5445a87fbb81bb7a4b365
EndOfMessage
) \
&& \
query_id=`aws logs start-query --log-group-name /aws/lambda/console_log \
--start-time $(TZ='UTC' date -d "-1 day" +%s%3N) \
--end-time $(TZ='UTC' date +%s%3N) \
--query-string "$query_string" --output text` \
&& \
aws logs get-query-results --query-id $query_id | python -m json.tool

Take special note that CloudWatch will automatically create a new field/column in the query result using the Regex named group from the parse statement as the field name. So in the above query, a new field will be created named transId because of this name group ?<@transId>

Additionally, you don't have to specify the new field which you're creating from the parse statement in the field statement. CloudWatch will automatically include that field in the query result. I included in this example just for demonstration purposes