4.1.3 Query Logs to Find Relevant Data

-- Find errors
fields @timestamp, @message
| filter @message like /ERROR/
| sort @timestamp desc
| limit 20

-- P99 latency
stats pct(@duration, 99) as p99 by bin(1h)

-- Cold starts count
filter @message like /Init Duration/
| stats count(*) as coldStarts by bin(5m)

-- Top 10 slowest invocations
fields @duration, @requestId
| sort @duration desc
| limit 10

-- Error rate
stats count(*) as total,
      sum(strcontains(@message, "ERROR")) as errors
| display errors/total * 100 as error_rate

-- Find specific request
fields @timestamp, @message
| filter @requestId = "abc-123-def"

Log Group: /aws/lambda/my-function
  └── Log Stream: 2025/01/15/[$LATEST]abc123
       └── Log Events

fields @timestamp, eventName, errorCode, errorMessage, userIdentity.arn
| filter errorCode = "AccessDenied"
| sort @timestamp desc
| limit 20

-- Query CloudTrail logs exported to S3
SELECT eventname, sourceipaddress, errorcode
FROM cloudtrail_logs
WHERE errorcode = 'AccessDenied'
  AND eventtime > '2025-01-01'
ORDER BY eventtime DESC;

-- Query ALB access logs trong S3
SELECT target_status_code, count(*) as cnt
FROM alb_logs
WHERE target_status_code >= 500
GROUP BY target_status_code;