I haven’t used Cloud Watch personally. And since V9 is not released yet we don’t have documentation for this one.
But its query runner accepts YAML input and passes the key-value-pairs directly into Amazon’s
boto3 Python adapter. There’s some examples in this SO question. You’ll need to provide a
logGroupName. So your query would look like this:
logGroupName: <whatever log group you need>
startTime: <your desired startTime string>
queryString: fields @timestamp,body.id,body.to_pause_months,@message | filter ispresent(body.id) | sort @timestamp desc | limit 20
I believe you can insert newline characters in the queryString without impacting the query (which helps readability).
If you don’t provide an
endTime key-value-pairt it’s implicitly the time of execution.