Using AWS CLI to query CloudWatch Logs with Insights. Looking -30 mins to now.

query-aws-logs-insights.bash

# this script queries aws logs with insights filtering on ERROR

# explanation of start and end times
#--start-time = unix timestamp 30 mins in the past
#--end-time = unix timestamp now

QUERY_ID=$(aws logs start-query \
 --profile $profile \
 --log-group-name /aws/lambda/aap-event-consumer-dev \
 --start-time `date -v-30M "+%s"` \
 --end-time `date "+%s"` \
 --query-string 'fields @message filter @message like /ERROR/' \
 | jq -r '.queryId')
 
echo "Query started (query id: $QUERY_ID), please hold ..." && sleep 5 # give it some time to query

aws --profile $profile logs get-query-results --query-id $QUERY_ID

Also, I had to change query-string

from

'fields @message filter @message like /ERROR/'

to

'fields @message | filter level like "error"'