4.3.9 Use Logs to Identify Bottlenecks

-- Top 10 slowest Lambda invocations
fields @duration, @requestId, @message
| sort @duration desc
| limit 10

-- P50, P90, P99 latency
stats pct(@duration, 50) as p50,
      pct(@duration, 90) as p90,
      pct(@duration, 99) as p99
by bin(1h)

-- Cold start frequency
filter @message like /Init Duration/
| stats count(*) as coldStarts by bin(5m)

-- Memory usage trends
filter @type = "REPORT"
| stats max(@maxMemoryUsed) as maxMem,
        avg(@duration) as avgDuration
by bin(1h)

-- Error patterns
filter @message like /ERROR/
| stats count(*) as errorCount by @message
| sort errorCount desc
| limit 10

-- Find functions approaching timeout
filter @type = "REPORT"
| filter @duration > 10000
| fields @requestId, @duration, @maxMemoryUsed
| sort @duration desc

-- Slow API calls
fields @timestamp, httpMethod, resourcePath, status, responseLatency
| filter responseLatency > 1000
| sort responseLatency desc
| limit 20

CloudWatch Logs → Subscription Filter → Lambda → Alert/Process