3

is there a way the results of Cloudwatch query can be used to parameterise the filter condition of a separate query?

So consider I have a query like so to grab some correlationIds out of one log group

Log Group A

fields correlationId, @timestamp, @message, @logStream, @log
| filter endpoint = 'PutServiceOption'
| filter params.ServiceOptionID = '47'
| filter response.result.StatusCode = 'PS000'
| filter strcontains(@message, '"AvailabilityData":[]')

and then I want to find corresponding entries in another log group that match these id's retrieved from my query above, something like:

Log Group B

fields fieldA, fieldB, fieldN..., @timestamp, @message, @logStream, @log
| filter correlationId IN (correlationIds found from Log Group A results)

I know I can select multiple log groups in the console to query over and have done that before when I want to retrieve all records that match a common filter condition. But I think this is a bit different since I want to be able to really do a nested query I guess.

I believe this kinda thing may have been asked before on AWS forums like - How To Filter on a subquery in Amazon Cloudwatch Insights

But I'm not sure if this feature exists yet in Cloudwatch, or if there is a better tool or technique to be using here.

Anyone come across this and found a way? Thanks

Improve this question
1
  • 1
    Specifically about where you ask "... or if there is a better tool or technique to be using here", if you're trying to correlate requests from multiple different services then using Open Telemetry would automatically aggregate the Spans from multiple services and show you the entire transaction in a Trace. Commented Jul 30 at 8:19
Related questions
75
Filter by timestamp query on AWS Cloudwatch Logs Insights
34
AWS Cloudwatch Logs Insights find logs close to another log or timestamp
2
Using nested query in AWS log insights
Load 5 more related questions Show fewer related questions

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.