JA EN
shiichan

CloudWatch Logs Insights adds 25 new commands: your log analysis just got smarter!

AWS What's New ★★★★ View Markdown
#aws#infrastructure#devops

Hi everyone, it's Shiichan! Today I found an update that log-analysis fans are going to love. CloudWatch Logs Insights' query language just got a big power-up!

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced that Amazon CloudWatch Logs Insights' query language now supports 25 new commands and functions, expanding what you can do to query, transform, correlate, and analyze logs.

Why it matters

When you're analyzing logs in CloudWatch Logs Insights, you often need to do statistical aggregation, handle null values in time-series data, compare logs across time windows, detect outliers, or enrich events with lookup data. Doing this used to take extra work outside the query language, but now you can do it directly in your queries.

What changes

Here's how the new commands and functions break down by purpose:

  • Type conversion & encoding: hexToAscii, hexToDec, decToHex
  • Date & time: parseDate, formatDate, queryStartTime, queryEndTime, queryTimeRange
  • String: messageSize
  • JSON inspection: jsonArraySize, jsonArrayContains
  • Conditional validation: isNumeric
  • Statistics: variance, topk, countFrequent
  • Row-sequencing & null-handling: autoregress, accum, filldown, fillmissing
  • Sessionization & time comparison: sessionize, logcompare
  • Data analysis: outlier
  • Query composition & joins: where, appendcols
  • Lookup enrichment: cidrlookup

With this set, you can build queries that compare logs across time windows with logcompare, surface unusual behavior with outlier, or enrich an IP address with its network info via cidrlookup, all without leaving CloudWatch. Work that used to mean exporting data to another tool or crunching numbers by hand can now stay inside a single query.

Dive Deep

Here's what the source article says about availability.

  • Available today in all commercial AWS Regions
  • Detailed syntax and parameters for each command live in the Amazon CloudWatch Logs documentation

The article doesn't mention pricing or the full syntax for each command, so check the docs if you want to try these out.

Wrap-up

  • CloudWatch Logs Insights' query language gains 25 new commands and functions
  • Coverage spans type conversion, date/time, strings, JSON inspection, statistics, null-handling, sessionization, time comparison, outlier detection, joins, and lookups
  • Available today in every commercial AWS Region

If you regularly analyze logs in CloudWatch Logs Insights, this is worth trying right away to see how much more expressive your queries can get!

Related posts