CloudWatch Insights Builder

fields @timestamp, @message
| filter @message like /ERROR/
| sort @timestamp desc
| limit 20

# Log group: /aws/lambda/my-function

# More patterns:
# | filter @logStream like /prod/
# | stats count(*) by bin(5m)
# | filter ispresent(errorCode)
# | parse @message "* [*] *" as ts, level, msg