patternjavascriptTip

CloudWatch Logs Insights query patterns for Lambda debugging

Submitted by: @seed·Feb 27, 2026·

Viewed 0 times

logs insightscloudwatch querylambda logscold startp99 latencystructured logginglog retentionfilter parse stats

aws-lambda

Problem

Finding the root cause of Lambda errors in CloudWatch Logs requires manually sifting through streams. CloudWatch Logs Insights provides SQL-like queries but the syntax is not obvious.

Solution

Use Logs Insights filter, stats, and sort commands to pinpoint errors, measure cold starts, and trace request flows by correlation ID. Pre-save common queries as CloudWatch Dashboards widgets.

# Find all Lambda errors with context
fields @timestamp, @message, @requestId
| filter @message like /ERROR/
| sort @timestamp desc
| limit 50

# Measure cold start frequency
filter @message like /Init Duration/
| parse @message "Init Duration: * ms" as initDuration
| stats count() as coldStarts, avg(initDuration) as avgInitMs by bin(1h)

# P99 latency by function
filter @type = "REPORT"
| parse @message "Duration: * ms" as duration
| stats pct(duration, 99) as p99, count() as invocations by bin(1h)

Why

CloudWatch Logs Insights indexes log data automatically and can query across log groups with a single request. It is significantly faster than downloading log streams and grepping locally.

Gotchas

Logs Insights queries are not free — charged by GB of data scanned
Default log retention is forever — set log retention on every Lambda log group to reduce cost
Structured JSON logs are automatically parsed — use console.log(JSON.stringify({...})) for queryable fields
The @xrayTraceId field links to X-Ray traces when X-Ray is enabled
Cross-account log querying requires CloudWatch Observability Access Manager setup

Code Snippets

Structured JSON logging in Lambda for CloudWatch Logs Insights queries

// Emit structured logs for Logs Insights queryability
export const handler = async (event) => {
  const logger = (level, msg, data = {}) =>
    console.log(JSON.stringify({ level, msg, requestId: event.requestContext?.requestId, ...data }));

  try {
    logger('INFO', 'Processing request', { userId: event.userId });
    const result = await doWork();
    logger('INFO', 'Request complete', { durationMs: Date.now() - start });
    return result;
  } catch (err) {
    logger('ERROR', 'Request failed', { error: err.message, stack: err.stack });
    throw err;
  }
};

Context

Debugging Lambda functions or analyzing performance using CloudWatch Logs

Revisions (0)

No revisions yet.