aws cloudwatch - log analytics options used to query logs

We can use multiple approach to query a logs in cloudwatch - log analytics.

1. Logs Insights QL (the native language)  

Example of query would look similiar to this 

SOURCE logGroups(namePrefix: [], class: "STANDARD") START=-3600s END=0s |

fields @timestamp, @message

| filter @message like /Error/

| sort @timestamp desc

| limit 10000

2. OpenSearch Structured Query Language (SQL) 

For teams that prefer industry-standard database syntax, CloudWatch supports OpenSearch SQL. It is highly useful if you need to perform relational actions like JOIN commands across logs.

SOURCE "arn:aws:logs:ap-southeast-2:042005083034:log-group:/aws/lambda/my-function" START=-3600s END=0s |

SELECT status, COUNT(*) FROM log_group_name

3. OpenSearch Piped Processing Language (PPL)

OpenSearch PPL is an alternative pipeline-based query language. It allows you to process data sequentially through a series of chained commands. 

SOURCE "arn:aws:logs:ap-southeast-2:042005083034:log-group:/aws/lambda/mytest-function-for-alias" START=-3600s END=0s |

search source=log_group_name | where status='Error' | stats count() by timestamp