26

I have two Cloudwatch insights queries that I would love to be able to run side by side and compare the results of both two.

stats count(*) as requestIdCount by @requestId | filter @message like /START RequestId/ | filter requestIdCount > 1 
stats count(*) as requestIdCount by @requestId | filter @message like /END RequestId/ | filter requestIdCount > 1

It would be great to be able to do

fields ( stats count(*) as requestIdCount by @requestId | filter @message like /END RequestId/ | filter requestIdCount > 1) as EndRequestCount, ( stats count(*) as requestIdCount by @requestId | filter @message like /START RequestId/ | filter requestIdCount > 1) as StartRequestCount

But I don't see any way to do subqueries in insights right now. Is there a method to combine queries like this?

Improve this question
2
  • I would like to know how I can to do it too :) Commented Oct 2, 2020 at 4:05
  • I am in the club. I need to do it and I have no idea Commented Dec 3, 2020 at 18:38

2 Answers 2

Reset to default
16

Try this:

parse @message 'START RequestId' as @startRequestId | parse @message 'END RequestId' as @endRequestId | stats count(@startRequestId) as startRequestIdCount , count(@endRequestId) as endRequestIdCount by bin(5m) | filter startRequestIdCount > 1 | filter endRequestIdCount > 1

CloudWatch Logs Insights Query Syntax

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

exactly what I needed, thank you!! This works perfectly
-2

You can create a logic via API or CLI in order to use the output of a query as the input of another query

It works as a script where you make a request, interpret the results, and then issue another requests with the results of the first one. It's a bit more work but I'm not aware of another way to do so

Improve this answer

1 Comment

This sounds like a useful suggestion, but the links don't provide clarification (or may be inaccurate links). Please provide more detail, such as an example

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.