AWS Cloudwatch Logs Insights find logs close to another log or timestamp

Question

On AWS Cloudwatch Log Insights, often after you filter your logs and find an interesting log message you want to see what was happening right before or after that message.

What is the best way to find log messages right next to another message?
I imagine a good way is to filter based on @tiemstamp and they conveniently provide a date_floor function, but I cannot figure out the syntax that works for equality to timestamps.

I have also be wondering how to do this. We also use Kibana and it has a view surrounding logs feature which is very useful. I can't find a way to do this in CloudWatch though. — David Jones, Jul 21 '20 at 10:45

Eric Le Fort · Answer 1 · 2021-11-17T05:35:12.863

27

In Logs Insights, if you query for:

fields @timestamp, @message, @logStream
     | filter @message like /<Your Log Message>/

you'll get a link where you can access the log stream. Clicking there will bring you right to the context before/after the log you're interested in.

It's a fair bit of work for something that should be a single click but it's the only work-around I'm aware of. Feel free to go bug the AWS team to build this as a 1-click feature right from the logs themselves.

Edit: Something I didn't know when I wrote this answer: this trick only works if you're querying a single log group. If you're querying multiple, it still shows the logStream but it's not clickable.

edited Nov 17 '21 at 05:35

answered Aug 05 '20 at 22:08

Eric Le Fort

2,571
18
24

2

so the trick is the @logStream , nice, thanks for sharing – Ali Aug 08 '20 at 22:21
1

but my result has around 1k rows, so I ll have 1k links. Clicking 1k links isnt a good option at all – Omkar Kulkarni Aug 03 '21 at 14:27
There must be an option like surrounding logs which ELK stack has. Dont know why AWS has not provided – NIrav Modi Aug 24 '22 at 06:28
If you're querying multiple log groups, you'll also need to add `@log` to the list of fields – Shelvacu Sep 14 '22 at 16:12

AWS Cloudwatch Logs Insights find logs close to another log or timestamp

1 Answers1