Understanding CloudWatch Logs Insights

CloudWatch Logs Insights enables you to interactively search and analyze your log data in Amazon CloudWatch Logs. You can use it to identify issues, track trends, and gain insights into your applications.

• CloudWatch Logs Insights Query Syntax Examples

Example Loglines

Example log lines that can be analyzed:

172.31.37.134 - - [07/Jul/2020 13:18:34] "GET / HTTP/1.1" 200 -
172.31.37.134 - - [07/Jul/2020 13:18:34] "GET /status HTTP/1.1" 200 -

Show All Logs

Query to display all logs:

fields @message

Show Most Recent Log Entries

Query to show the 25 most recent log entries:

fields @timestamp, @message | sort @timestamp desc | limit 25

Show Logs with Parsed Fields

Query to show all logs and include parsed fields:

fields @message, @log, @logStream, @ingestionTime, @timestamp

Filter Logs by Content

Query to only show logs containing /status:

fields @message | filter @message like '/status'

View EKS Audit Logs

Query to view EKS audit logs for delete verbs:

fields @timestamp, @message, @logStream, @log
| filter objectRef.namespace = 'dev' and objectRef.resource like /service.*/ and verb = 'delete'
| sort @timestamp desc
| limit 20

Select Logstream and Filter by String

Query to select the logstream and filter on a string content:

fields @timestamp, @message, @logStream
| sort @timestamp desc 
| filter @logStream = 'cb2a300000000000000000003b3' 
| filter @message like 'msg='

Select Logstream and Filter Out String

Query to select the logstream and filter out string content:

fields @timestamp, @message, @logStream | sort @timestamp desc 
| filter @logStream = 'cb2a300000000000000000003b3' 
| filter @message not like "Something I dont want to see"

Filter Out Multiple Strings

Query to filter out multiple strings:

fields @timestamp, @message, @logStream | sort @timestamp desc 
| filter @logStream = 'cb2a300000000000000000003b3'  
  and not (
    @message like "Something I dont want to see" or
    @message like "also dont want to see this" or
    @message like "or even this"
  )