Amazon CloudWatch Logs Insights is a powerful tool that allows you to interactively search and analyze your log data in the AWS CloudWatch environment. It provides a queryable interface for examining logs, enabling you to efficiently troubleshoot operational issues and monitor system performance. One of the common tasks when working with CloudWatch Logs Insights is searching for plain text within your logs.

This article will delve into the technical details of how to perform plain text searches in CloudWatch Logs Insights, using examples to illustrate key concepts and techniques.

Overview of CloudWatch Logs Insights

CloudWatch Logs Insights enables you to query logs using a custom query language designed for this purpose. It supports features like pattern discovery, aggregation, and visualization to aid in log analysis. The basic building blocks of the query language are:

• Fields: Specify the fields from log entries you want to return. • Filter: Filter log events based on conditions. • Statistics Functions: Calculate aggregate statistics over your log data. • Sort: Order your results. • Limit: Control the number of results returned.

Each log entry is treated as a separate JSON object, and the language allows you to perform operations on these objects.

Searching for Plain Text

When searching for plain text within CloudWatch Logs Insights, the `filter` command is essential. You can use it to specify text that should match within the log events. For example, if you are looking for logs containing the phrase "ERROR", you would write a query like the following:

• `fields @timestamp, @message`: This line specifies that the query should return the timestamp and message fields of each log entry. • `filter @message like /ERROR/`: This applies a filter that returns only log entries where the `@message` field contains the word "ERROR". The `like` operator supports regular expression matching, making it a powerful tool for text searches. • `sort @timestamp desc`: The results are sorted in descending order based on the timestamp, showing the most recent logs first. • `limit 20`: This limits the results to 20 entries for easier viewing.

• `like /ERROR\s*\d{3}/`: This pattern searches for the word "ERROR" followed by optional whitespace (`\s*`) and a three-digit number (`\d{3}`).

• `parse @message /ERROR (?``<errorCode>``\d&#123;3&#125;)/`: This extracts the three-digit error code from the message, storing it in a field called `errorCode`.

• `stats count(*) by bin(1h)`: This aggregates the data, counting the number of errors per hour.