aws cloudwatch logs filter pattern include lines before and/or after matching pattern

Question

Is there a way to include N lines before and/or after a matching pattern in AWS CloudWatch Logs?

Let's say I have this query and would like 3 lines before and after each match.

aws logs filter-log-events --log-group-name my-group --filter-pattern "mypattern"

The only work around I have at the moment is to remove the filter pattern and use grep:

aws logs filter-log-events --log-group-name my-group | grep -A 3 -B 3 mypattern

However, I would like to only stream the log events I need and do it as part of the aws log events query.

Answer 1

This is currently not supported by AWS (confirmed by a contributor), but there is an open GitHub issue for tracking the feature to potentially support this in the future.

In the meantime, you will have to resort to filtering after the logs are streamed as mentioned in the question.

aws logs filter-log-events --log-group-name my-group | grep -A 3 -B 3 mypattern

Answer 2

I had exactly the same problem, and found simply searching by timestamp solved my issue to some extent.

CloudWatch has "Logs Insights", which is a fluent log searcher.

Search by a keyword and get the timestamp, then filter nearby logs with the timestamp.