aws logs filter-log-events: Search CloudWatch Logs in CI
aws logs filter-log-events returns log events from a CloudWatch log group matching a filter pattern within a time window, the scriptable way for CI to assert on a deployed service's logs.
A post-deploy smoke test often greps the function or service logs for an error. filter-log-events does this server-side; the trap is that times are epoch milliseconds, not seconds.
What it does
aws logs filter-log-events scans --log-group-name for events matching --filter-pattern between --start-time and --end-time (both epoch milliseconds). It paginates automatically and returns events with timestamps and messages.
Common usage
# Errors in the last 10 minutes
START=$(( ($(date +%s) - 600) * 1000 ))
aws logs filter-log-events \
--log-group-name /aws/lambda/my-fn \
--start-time "$START" \
--filter-pattern '?ERROR ?Exception' \
--query 'events[].message' --output textOptions
| Flag | What it does |
|---|---|
| --log-group-name <name> | Log group to search (required) |
| --filter-pattern <pat> | CloudWatch filter syntax (? = OR, "..." literal) |
| --start-time / --end-time <ms> | Window in epoch MILLISECONDS |
| --log-stream-names <name...> | Restrict to specific streams |
| --query events[].message | Pull just the message text |
In CI
The biggest gotcha: times are milliseconds. $(date +%s) gives seconds, so multiply by 1000 or every query returns nothing. The filter syntax is not regex: ?ERROR ?Exception means match ERROR OR Exception, and quoted strings are literal substrings. For tailing live logs interactively, aws logs tail --follow is friendlier, but filter-log-events is better for scripted assertions over a window.
Common errors in CI
"An error occurred (ResourceNotFoundException) when calling the FilterLogEvents operation: The specified log group does not exist" means a wrong name or that the service has not logged yet (the group is created on first write). An empty result is usually a seconds-vs-milliseconds time bug, not a missing match. "AccessDeniedException" means missing logs:FilterLogEvents. "ThrottlingException: Rate exceeded" hits when many jobs poll; back off.