10 CloudWatch Logs Insights examples for serverless applications
Tags: aws, serverless, cloudwatch
Published: 2022-04-04 14:50:28

---
title: 10 CloudWatch Logs Insights examples for serverless applications
published: true
description: CloudWatch Logs Insights examples that will make your life easier when you are using serverless applications.
tags: AWS, serverless, CloudWatch
cover_image: https://www.globalwoodmarketsinfo.com/wp-content/uploads/2017/11/TCLC-Logs.jpg
canonical_url: https://cloudash.dev/blog/cloudwatch-logs-insights-examples
---

CloudWatch Logs Insights is a CloudWatch feature that allows you to interactively search and analyze your log data in Amazon CloudWatch Logs. You can perform queries to help you more efficiently and effectively respond to operational issues, diagnose problems, and troubleshoot application performance.

[CloudWatch Logs Insights syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html) can be difficult to learn, that's why this post contains 10 CloudWatch Logs Insights examples for serverless applications we find useful in our daily work as serverless engineers.

## Find all logs for a given request ID or X-Ray trace ID

```
fields @timestamp, @message
| filter @message like /REQUEST_ID_GOES_HERE/
```

**Note:** `/REQUEST_ID_GOES_HERE/` is a placeholder for the actual request ID/`xRayTraceId` you want to search for. Bear in mind that `/something/` is a regular expression.

## Find 50 most recent errors

```
fields Timestamp, LogLevel, Message
| filter LogLevel == "ERR"
| sort @timestamp desc
| limit 50
```

## Find the most expensive Lambda function invocations

```
filter @type = "REPORT"
| fields @requestId, @billedDuration
| sort by @billedDuration desc
```

## View latency stats for 5-minute intervals for a Lambda function

```
filter @type = "REPORT"
| stats avg(@duration), max(@duration), min(@duration) by bin(5m)
```

## Determine the amount of overprovisioned memory for a Lambda function

```
filter @type = "REPORT"
| stats max(@memorySize / 1024 / 1024) as provisonedMemoryMB,
  min(@maxMemoryUsed / 1024 / 1024) as smallestMemoryRequestMB,
  avg(@maxMemoryUsed / 1024 / 1024) as avgMemoryUsedMB,
  max(@maxMemoryUsed / 1024 / 1024) as maxMemoryUsedMB,
  provisonedMemoryMB - maxMemoryUsedMB as overProvisionedMB
```

**Note:**

> Lambda allocates CPU power in proportion to the amount of memory configured. Memory is the amount of memory available to your Lambda function at runtime. You can increase or decrease the memory and CPU power allocated to your function using the Memory (MB) setting.

## Find a non-200 error in API Gateway Execution Logs

```
fields @timestamp, @message, @requestId, @duration, @xrayTraceId, @logStream, @logStream
| filter
   @message like /fail/ or
   @message like /timed/ or
   @message like /X-Amz-Function-Error/ or
   @message like /tatus: 4/ or
   @message like /tatus: 5/
| sort @timestamp desc
```

## Count a number of cold starts, average init time and maximum init duration of a Lambda function

```
filter @type="REPORT"
| fields @memorySize / 1000000 as memorySize
| filter @message like /(?i)(Init Duration)/
| parse @message /^REPORT.*Init Duration: (?<initDuration>.*) ms.*/
| parse @log /^.*\/aws\/lambda\/(?<functionName>.*)/
| stats count() as coldStarts, avg(initDuration) as avgInitDuration, max(initDuration) as maxIntDuration by functionName, memorySize
```

## Lambda cold start percentage over time

```
filter @type = "REPORT"
| stats
  sum(strcontains(
    @message,
    "Init Duration"))
  / count(*)
  * 100
  as coldStartPercentage,
  avg(@duration)
  by bin(5m)
```

Credit: https://github.com/julianwood/serverless-cloudwatch-logs-insights-examples

## Show average duration, max duration, min duration, P99 percentile duration and request count

```
filter @type = "REPORT"
| stats avg(@duration), max(@duration), min(@duration), pct(@duration, 99), count(@duration) by bin(5m)
```

## Exclude informational logs to highlight only Lambda errors

```
fields @timestamp, @message
| sort @timestamp desc
| filter @message not like 'EXTENSION'
| filter @message not like 'Lambda Insights'
| filter @message not like 'INFO'
| filter @message not like 'REPORT'
| filter @message not like 'END'
| filter @message not like 'START'
```

---

CloudWatch Logs Insights queries are not free (although there is a free tier). For instance for in us-east-1 AWS will charge you $0.005 per GB of data scanned for a query. Note that according to [Amazon CloudWatch FAQ](https://aws.amazon.com/cloudwatch/faqs/) you won't be charged for failed queries and if you cancel a query manually, you are charged for the amount of ingested log data scanned up to the point at which you cancelled the query.

Find out more at https://aws.amazon.com/cloudwatch/pricing/

---

## Stay on top of your logs. ⚡️

![Cloudash screenshot](https://cloudash.dev/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fcloudash_function.6e0454ea.png&w=3840&q=75)

Introducing [Cloudash](https://cloudash.dev), a desktop app for monitoring your serverless services performance, invocations, errors and more.

Did a production incident happen last week? Or 20 seconds ago? With Cloudash you can search, filter and browse your serverless logs and metrics effortlessly.

Search for whatever you want, whenever you want. Cloudash comes with built-in filtering capabilities enabling to get to the bottom of your problems faster than ever before.

Get started [here](https://cloudash.dev).