Simplify loginsights

chrisguest75 · Dec 15, 2023 · d1cc98b · d1cc98b
1 parent 57002c1
commit d1cc98b
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/33_awscli/LOGINSIGHTS.md b/33_awscli/LOGINSIGHTS.md
@@ -19,10 +19,11 @@ aws logs describe-log-groups | jq -r '.[][] | .logGroupName'
 LOGGROUP=myloggroup
 
 # over two weeks (end time is required)
-QUERYID=$(aws logs start-query --log-group-name ${LOGGROUP} --start-time $(date -v-14d '+%s') --end-time $(date '+%s') --query-string "fields @timestamp, @message, @logStream, @log | filter @message like /EAI_AGAIN/ | sort @timestamp desc" | jq -r .queryId)
-
+STARTTIME=$(date -v-14d '+%s')
 # start from a specfic date and time
-QUERYID=$(aws logs start-query --log-group-name ${LOGGROUP} --start-time $(date -d "2023-12-14 12:00:00" +"%s") --end-time $(date '+%s') --query-string "fields @timestamp, @message, @logStream, @log | filter @message like /EAI_AGAIN/ | sort @timestamp desc" | jq -r .queryId)
+STARTTIME=$(date -d "2023-12-14 12:00:00" +"%s")
+
+QUERYID=$(aws logs start-query --log-group-name ${LOGGROUP} --start-time $STARTTIME --end-time $(date '+%s') --query-string "fields @timestamp, @message, @logStream, @log | filter @message like /EAI_AGAIN/ | sort @timestamp desc" | jq -r .queryId)
 
 # use id to get logs 
 aws logs get-query-results --query-id $QUERYID | jq .