CloudWatchのlog insightでの調査例

filter @logStream like 'app/app/'
| filter @message like /include/
| filter @message not like /exclude/
| filter duration > 100
 | fields @timestamp, @message, duration