---
cuppy_hub: aws
cuppy_path: reference/cloudwatch/logs-insights-queries.md
cuppy_section: docs
cuppy_doc: W5EK-WDA7
cuppy_doc_uuid: 33758a50-f122-481e-8035-9649ff3fce6c
cuppy_permalink: https://cuppy.io/aws/d/W5EK-WDA7
cuppy_version: 4
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/aws/docs/reference/cloudwatch/logs-insights-queries
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: b411fe562faa53a40f7f0525d63f282214ea92b17b1e293a236be388e678bcbf
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Logs Insights queries for the hub's error catalogues

**Run each query against the log group named in its heading, over the shortest window that contains the failure.** Queries marked *(AWS sample)* are copied from AWS's examples page. The rest were composed for this hub from documented commands and fields and haven't been run against live logs, so adjust field names to your log format. Field and limit rules are in `guides/cloudwatch/query-logs.md`.

## Lambda: `/aws/lambda/<function>`

**Timeouts and runtime errors** (strings from `reference/lambda/errors.md`):

```
fields @timestamp, @requestId, @message
| filter @message like /Task timed out after|Runtime\.[A-Za-z]+|ERROR/
| sort @timestamp desc
| limit 50
```

**Count errors by kind, every 5 minutes:**

```
filter @message like /Task timed out after|Runtime\./
| parse @message /(?<kind>Task timed out|Runtime\.[A-Za-z]+)/
| stats count(*) as n by kind, bin(5m)
| sort n desc
```

**Slow invocations, one row per request** *(AWS sample)*. `@duration` is in milliseconds:

```
fields @timestamp, @requestId, @message, @logStream
| filter @type = "REPORT" and @duration > 1000
| sort @timestamp desc
| dedup @requestId
| limit 20
```

**Latency over time** *(AWS sample)*:

```
filter @type = "REPORT" |
    stats avg(@duration), max(@duration), min(@duration) by bin(5m)
```

**Memory headroom** *(AWS sample; "provisonedMemoryMB" is AWS's spelling)*. A small `overProvisionedMB` means the function is close to running out of memory:

```
filter @type = "REPORT"
    | stats max(@memorySize / 1000 / 1000) as provisonedMemoryMB,
        min(@maxMemoryUsed / 1000 / 1000) as smallestMemoryRequestMB,
        avg(@maxMemoryUsed / 1000 / 1000) as avgMemoryUsedMB,
        max(@maxMemoryUsed / 1000 / 1000) as maxMemoryUsedMB,
        provisonedMemoryMB - maxMemoryUsedMB as overProvisionedMB
```

**JSON log format** (`LogFormat=JSON`; application fields are `timestamp`, `level`, `message` and `requestId`):

```
fields @timestamp, level, message, requestId, errorType, errorMessage
| filter level = "ERROR"
| sort @timestamp desc
| limit 50
```

## VPC Flow Logs: the flow log's log group (default format)

**What got rejected, by destination port** (reading the results: `reference/vpc/flow-logs.md`):

```
filter action = "REJECT"
| stats count(*) as rejects by dstAddr, dstPort, protocol
| sort rejects desc
| limit 25
```

**Rejects for one instance or ENI** (a timeout you're chasing):

```
fields @timestamp, srcAddr, srcPort, dstAddr, dstPort, action
| filter interfaceId = "eni-0123456789abcdef0" and action = "REJECT"
| sort @timestamp desc
```

**Top talkers in a subnet** *(AWS sample)*:

```
filter isIpv4InSubnet(srcAddr, "192.0.2.0/24")
    | stats sum(bytes) as bytesTransferred by dstAddr
    | sort bytesTransferred desc
    | limit 15
```

## CloudTrail: a trail's log group

**Failed calls by error** *(AWS sample, widened from one event to all)*:

```
filter ispresent(errorCode)
| stats count(*) by errorCode, errorMessage
```

**Access denied, by who and what:**

```
filter errorCode like /AccessDenied|UnauthorizedOperation/
| stats count(*) as denials by userIdentity.arn, eventSource, eventName
| sort denials desc
| limit 25
```

Then read a single `errorMessage` with `guides/iam/fix-access-denied.md`.

**Who deleted things today:**

```
fields @timestamp, eventName, eventSource, userIdentity.arn, sourceIPAddress
| filter readOnly = 0 and eventName like /^Delete/
| sort @timestamp desc
| limit 100
```

JSON booleans may compare as `0`/`1` or `"false"`; try `readOnly = "false"` if this returns nothing (UNVERIFIED type handling).

**One resource's history:**

```
fields @timestamp, eventName, userIdentity.arn, errorCode
| filter requestParameters.bucketName = "my-bucket"
| sort @timestamp desc
```

`requestParameters` field names depend on the API (`bucketName`, `functionName`, …). They are dropped from records over 100 KB.

## API Gateway: access-log group (fields as in your access-log format)

**Last 4xx** *(AWS sample)*:

```
fields @timestamp, status, ip, path, httpMethod
| filter status>=400 and status<=499
| sort @timestamp desc
| limit 10
```

**5xx by path:**

```
filter status >= 500
| stats count(*) as errors by path, status
| sort errors desc
```

## Route 53 query logs

**SERVFAIL by name** *(AWS sample)*:

```
filter responseCode="SERVFAIL" | stats count(*) by queryName
```

## Any log group

**25 most recent events** *(AWS sample)*:

```
fields @timestamp, @message | sort @timestamp desc | limit 25
```

**Exceptions per hour** *(AWS sample)*:

```
filter @message like /Exception/
    | stats count(*) as exceptionCount by bin(1h)
    | sort exceptionCount desc
```


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->