Using nested query in AWS log insights

Question

I am using AWS Lambdas to host some services. To mitigate issue of cold start, I'm using serverless plugin warmup .

Now using cloudwatch log insights, I intend to figure out p99/p95 of all the requests going to my lambda but exclude requests made by the plugin. For this one query which should help is , figure out requestIDs for plugin calls ( I'm logging a certain message based on which I can filter out those requests ). Now I want all those requests whose request IDS are not in these requests IDs. In sql this would transform to a nested query.

Rough version :

SELECT @duration from requestIDs where requestID not in ( SELECT RequestID where @message like ***** )

Do we have a way in which I can do such query in Log Insights?

Answer 1

Yes, you can remove messages from the warmup plugin by piping all messages to the filter with not like condition and then to pct(fieldName: LogFieldValue, percent: number) function:

fields @duration
| filter @message not like "MESSAGE TO EXCLUDE"
| stats pct(@duration, 99)