CloudWatch LogsInsights query via DotnetCDK

The error you're encountering is likely due to a few issues with your CloudWatch Logs Insights query definition.

First, in the CfnQueryDefinitionProps, you're using Name but the correct property name is name (lowercase). The AWS CDK is case-sensitive for property names.

Second, your query string contains some syntax that might not be compatible with CloudWatch Logs Insights. Specifically:

• The now() function in your filter statement may not be supported in the way you're using it
• The display command is not a standard CloudWatch Logs Insights command

Here's a corrected version of your code:

_ = new CfnQueryDefinition(this, "AllRecentLogs", new CfnQueryDefinitionProps
{
name = "All recent logs in stack",
logGroupNames = new[] {
"/aws/lambda/[REDACTED]",
"/aws/lambda/[REDACTED]",
"/aws/lambda/[REDACTED]"
},
queryString = "fields @timestamp, @message, @log, @logStream\n" +
"| filter @timestamp > ago(24h) and ispresent(MessageTemplate)\n" +
"| sort @timestamp desc\n" +
"| limit 10000"
});

Regarding log group prefixes: CloudWatch Logs Insights does support using log group prefixes in the console, but when using the CDK, you need to explicitly list all the log groups you want to query. The logGroupNames property only accepts an array of specific log group names, not prefixes. If you need to query log groups using a prefix pattern, you would need to either:

1. Retrieve all matching log groups programmatically before creating the query definition
2. Create a more generic query and then apply the prefix filter within the CloudWatch console when using it

Note that the query syntax has been simplified to use the ago(24h) function which is the proper way to reference a time period in the past in CloudWatch Logs Insights.

Additionally the error you're encountering suggests there might be an issue with how the CloudWatch Logs Insights query definition is being created through CDK. Let's try to troubleshoot this.

• First, it's worth noting that the CfnQueryDefinition is a low-level construct in CDK. For better type safety and ease of use, you might want to consider using the higher-level QueryDefinition construct from the aws-cdk-lib/aws-logs module.

• The error message "Invalid request provided: AWS::Logs::QueryDefinition" is quite generic, which makes it difficult to pinpoint the exact issue. However, there are a few things we can check:

a. Ensure that the Name property is unique within your AWS account and region.

b. Verify that all the log group names specified in LogGroupNames actually exist.
c. If you still encounter issues, you might want to try deploying a minimal version of this construct in isolation to see if the problem persists. This can help determine if the issue is with this specific resource or if there's a broader problem in your stack.

d. If the problem continues, you might want to enable CDK debug logging to get more detailed information about the deployment process. You can do this by setting the CDK_DEBUG=true environment variable before running your CDK commands.

Sources
class CfnQueryDefinition (construct) · AWS CDK
interface CfnQueryDefinitionProps · AWS CDK
Tutorial: Run and modify a sample query - Amazon CloudWatch Logs