Useful Insights queries - AWS Lambda

Useful Insights queries

The following table shows example Insights queries that can be useful for monitoring Lambda functions.

Description Example query syntax

The last 100 errors

 
 fields Timestamp, LogLevel, Message
 | filter LogLevel == "ERR"
 | sort @timestamp desc
 | limit 100

The top 100 highest billed invocations

 
filter @type = "REPORT"
| fields @requestId, @billedDuration
| sort by @billedDuration desc
| limit 100

Percentage of cold starts in total invocations

 
filter @type = "REPORT"
| stats sum(strcontains(@message, "Init Duration"))/count(*) * 100 as
  coldStartPct, avg(@duration)
  by bin(5m)

Percentile report of Lambda duration

 
filter @type = "REPORT"
| stats
    avg(@billedDuration) as Average,
    percentile(@billedDuration, 99) as NinetyNinth,
    percentile(@billedDuration, 95) as NinetyFifth,
    percentile(@billedDuration, 90) as Ninetieth
    by bin(30m)

Percentile report of Lambda memory usage

 
filter @type="REPORT"
| stats avg(@maxMemoryUsed/1024/1024) as mean_MemoryUsed,
    min(@maxMemoryUsed/1024/1024) as min_MemoryUsed,
    max(@maxMemoryUsed/1024/1024) as max_MemoryUsed,
    percentile(@maxMemoryUsed/1024/1024, 95) as Percentile95

Invocations using 100% of assigned memory

 
filter @type = "REPORT" and @maxMemoryUsed=@memorySize
| stats
    count_distinct(@requestId)
    by bin(30m)

Average memory used across invocations

 
avgMemoryUsedPERC,
    avg(@billedDuration) as avgDurationMS
    by bin(5m)

Visualization of memory statistics

 
filter @type = "REPORT"
| stats
    max(@maxMemoryUsed / 1024 / 1024) as maxMemMB,
    avg(@maxMemoryUsed / 1024 / 1024) as avgMemMB,
    min(@maxMemoryUsed / 1024 / 1024) as minMemMB,
    (avg(@maxMemoryUsed / 1024 / 1024) / max(@memorySize / 1024 / 1024)) * 100 as avgMemUsedPct,
    avg(@billedDuration) as avgDurationMS
    by bin(30m)

Invocations where Lambda exited

 
filter @message like /Process exited/
| stats count() by bin(30m)

Invocations that timed out

 
filter @message like /Task timed out/
| stats count() by bin(30m)

Latency report

 
filter @type = "REPORT"
| stats avg(@duration), max(@duration), min(@duration)
  by bin(5m)

Over-provisioned memory

 
filter @type = "REPORT"
| stats max(@memorySize / 1024 / 1024) as provisonedMemMB,
        min(@maxMemoryUsed / 1024 / 1024) as smallestMemReqMB,
        avg(@maxMemoryUsed / 1024 / 1024) as avgMemUsedMB,
        max(@maxMemoryUsed / 1024 / 1024) as maxMemUsedMB,
        provisonedMemMB - maxMemUsedMB as overProvisionedMB