PutLogEvents with timeStamp in past breaks Cloudwatch Insights

Hello,

I have read and re-read the putLogEvent limitations on all documentation and searched through all the forums, but cannot find a resolution to this problem.

If you use the sdk, on a lambda in this case, to putLogEvents with your own custom messages to cloudwatch, with a timestamp that is not "current" (anything in the past, even a couple hours or minutes), the log will be written to the logStream, BUT, cloudwatch insights will not observe those logs. (so cloudwatch insights cannot be used). Regardless of the timespan filtering in the cloudwatch insights, those logs are "missing". However, if you go back to your function and change the timestamp on the logMessage in the putLogEvents call to be the "current time" rather than the actual time of the log, then they will show up in the Cloudwatch insights.

I have seen others have had this issue with missing logs in insights, and given that you are able to publish logs to cloudwatch with a timestamp in the past, it seems that it is indeed a bug/miss that insights cannot search them. One would think you would be able to query logs in the past. Any resolution or "insight" into this would be greatly appreciated.

another reference: https://stackoverflow.com/questions/65924587/cloudwatch-query-does-not-work-if-timestamp-is-to-previous-date

Edited by: nmattei on Jul 27, 2021 9:53 AM