PyInsights

A CLI tool To query CloudWatch Logs Insights.

ToC

• Usage
  • Write Configuration
  • Execute command
• Configuration
  • version
  • log_group_name
  • query_string
  • duration
    • type: string
    • type: object
  • limit
• CLI Options
• Environment Variable

Usage

Write Configuration

Write configuration to pyinsights.yml like:

version: '1.0'
log_group_name:
  - '/ecs/sample'
query_string: 'field @message | filter @message like /ERROR/'
duration: '30m'
limit: 10

I wrote examples, so see examples folder.

Execute command

pyinsights -c pyinsights.yml -p aws_profile -r region

Configuration

version

Choose configuration version from ['1.0']

log_group_name

Target log group names to query

query_string

Specify CloudWatch Logs Insights query commands. Please see CloudWatch Logs Insights Query Syntax.

⚠️ If query_string type is array, Unix-style pipe | is not required. Execute in order from the top.

ex)

query_string:
  - 'field @message'
  - 'fileter @message like /WARN/'

Equal to

query_string: 'field @message | fileter @message like /WARN/'

duration

type: string

Specify weeks, days, hours, minutes or seconds unit.

weeks = w
days = d
hours = h
minutes = m
seconds = s

ex)

duration: 10h

type: object

Specify start_time and end_time. The format must be YYYY-MM-DD HH:MM:SS.

ex)

duration:
  start_time: '2020-01-01 00:00:00'
  end_time: '2020-01-01 01:00:00'

limit

The number of log to fetch. Of course, you can specify limit in query_string.

CLI Options

Environment Variable

If profile and region options are not specified, AWS Credentials must be set as environment variables.

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• AWS_DEFAULT_REGION

Please see Environment Variable Configuration for the detail.