Use aliases and comments in queries

Create queries that contain aliases. Use aliases to rename log fields or when extracting values into fields. Use the keyword as to give a log field or result an alias. You can use more than one alias in a query. You can use aliases in the following commands:

The following examples show how to create queries that contain aliases.

Example

The query contains an alias in the fields command.

fields @timestamp, @message, accountId as ID
| sort @timestamp desc
| limit 20

The query returns the values for the fields @timestamp, @message, and accountId. The results are sorted in descending order and limited to 20. The values for accountId are listed under the alias ID.

Example

The query contains aliases in the sort and stats commands.

stats count(*) by duration as time 
| sort time desc

The query counts the number of times the field duration occurs in the log group and sorts the results in descending order. The values for duration are listed under the alias time.

Use comments

CloudWatch Logs Insights supports comments in queries. Use the hash character (#) to set off comments. You can use comments to ignore lines in queries or document queries.

Example: Query

When the following query is run, the second line is ignored.

fields @timestamp, @message, accountId
# | filter accountId not like "7983124201998"
| sort @timestamp desc
| limit 20