Skip to content

Unable to retrieve CloudWatch Logs Insights queries filtered by query language "CWLI" via the AWS CLI

0

The AWS CLI's aws logs describe-queries command supports a --query-language option that should allow filtering at the API level for queries in a specific query language (CWLI, SQL or PPL). This appears to work for the "SQL" query language, but not for "CWLI".

A client-side filter using --query shows that I have logs insights queries with both "CWLI" and "SQL" query languages:

> aws logs describe-queries --query "length(queries[?queryLanguage=='CWLI'])"
52

> aws logs describe-queries --query "length(queries[?queryLanguage=='SQL'])"
20

Performing the same filtering via the API filter using the --query-language option produces the same result for "SQL" query language, but no results for the "CWLI" query language:

> aws logs describe-queries --query-language CWLI --query "length(queries)"
0

> aws logs describe-queries --query-language SQL --query "length(queries)"
20

Am I doing something wrong, or is this a bug in the API and/or AWS CLI?

asked a year ago158 views
1 Answer
0

Based on the information provided and the available documentation, it appears that you may be encountering an issue with the AWS CLI or the underlying API for CloudWatch Logs Insights when trying to filter queries by the "CWLI" query language.

The behavior you're describing, where client-side filtering shows results for both "CWLI" and "SQL" query languages, but API-level filtering only works for "SQL" and not for "CWLI", suggests there might be a discrepancy in how the API is handling the "CWLI" query language parameter.

CloudWatch Logs Insights does support multiple query languages, including Logs Insights Query Language (which is likely what "CWLI" refers to), SQL, and PPL (Piped Processing Language). The fact that you can see "CWLI" queries when using client-side filtering indicates that these queries do exist in your account.

However, the inability to filter for "CWLI" queries using the --query-language option in the aws logs describe-queries command could potentially be a bug or limitation in the API or CLI implementation.

To troubleshoot this issue, you could try the following:

  1. Ensure you're using the latest version of the AWS CLI.
  2. Try using the full name "CloudWatchLogsInsights" instead of "CWLI" for the query language parameter, if you haven't already.
  3. Check if the issue persists when using the AWS SDK or making direct API calls instead of using the CLI.
  4. If the problem continues, it would be advisable to contact AWS support or report this as a potential bug through the AWS forums or GitHub repository for the AWS CLI.

In the meantime, you may need to rely on client-side filtering using the --query option as a workaround to filter for "CWLI" queries.
Sources
Analyzing log data with CloudWatch Logs Insights - Amazon CloudWatch Logs
Troubleshoot a CloudWatch Logs Insights query that returns errors | AWS re:Post
CloudWatch Logs Insights language query syntax - Amazon CloudWatch Logs

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.