Module query 

CloudWatch Logs Insights query language parser and executor.

Supports the common subset of CWLI syntax as an ordered pipeline:

• fields @timestamp, @message / display ... — select output fields
• filter field = "value" / != / like /pattern/ — filter rows
• parse @message "* [*] *" as a, b, c — extract fields via a glob
• stats count(*) [as alias] by field, ... — aggregate (count/sum/avg/min/ max/count_distinct), optionally grouped
• dedup field, ... — drop duplicate rows by the given fields
• sort @timestamp desc — order rows
• limit N — cap row count

Structs

AggExpr

ParseSpec

A parse directive: glob pattern applied to source, binding each * wildcard (in order) to the corresponding name in names.

ParsedQuery

A parsed CWLI query: an ordered pipeline of commands.

QueryStream

One stream’s events for query execution.

Enums

AggFunc

Command

FilterClause

Functions

execute_query

Execute a parsed query against a set of streams, returning results in the CloudWatch Logs Insights format: an array of rows, each an array of {field, value} objects.

parse_query

Parse a CWLI query string into a structured pipeline.