15

Are you able to run a filter with a subquery in Cloudwatch Insights? I would like to take the requestID and find all logs related to it. I can run the queries separately but was trying to do it one.

Something like this:

filter @requestId in (filter @message like /Id 26313/ fields @requestId sort @timestamp desc limit 1)
| fields @message
| sort @timestamp desc
Matt Kenney
  • 165
  • 1
  • 6

2 Answers2

17

No. Subqueries are not currently possible.

gangreen
  • 849
  • 7
  • 9
0

Same question has been asked in the official AWS forum: https://repost.aws/questions/QU4IlWVGcbT3WA1PdhKCtkCw/nested-quires-for-cloud-insights

Their answer:

We already have an internal feature request for the same and I have gone ahead and associated this query to it in order to further escalate this feature. However please note that I cannot provide you with an ETA as to when this will be available.

As a possible workaround you can achieve this by programmatically running insights queries using StartQuery/GetQueryResults APIs[1][2] via custom code/script.

Ivaylo Mihaylov
  • 87
  • 9