Hello,

I would like to mention that currently Logs Insights query does not support nested queries.

We already have an internal feature request for the same and I have gone ahead and associated this query to it in order to further escalate this feature. However please note that I cannot provide you with an ETA as to when this will be available.

As a possible workaround you can achieve this by programmatically running insights queries using StartQuery/GetQueryResults APIs[1][2] via custom code/script.

I hope you find the above information useful.

Stay safe and have a nice day

References:

[1] https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_StartQuery.html [2] https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html

Hello AWS,

(Sorry, I'm looking for an answer here)

We already have an internal feature request for the same and I have gone ahead and associated this query to it in order to further escalate this feature. However please note that I cannot provide you with an ETA as to when this will be available.

I'm also in a need of using this kind of nested cloudwatch query. Just wondering if you have any planned date for this feature now.

Kind regards,

Pujitha.

I think it should be very commonplace to having to be able to group multiple log entries together based on filter criteria. E.g.:

fields @message, @timestamp
| parse @message "[*]" as requestId
| filter requestId in (
    fields @message
    | parse @message "[*]" as requestId
    | filter @message like /E -/
    | stats count() by requestId
    | fields requestId
)
| sort @timestamp desc
| limit 200

Should give me any related lines with that requestId.

Is it really that hart to build something like this?