Parsing a timestamp to use with CW Log Insights functions

Question

Attempting to use a built-in Cloudwatch Log function like "date_floor" with a 8601 timestamp string like "2020-03-24T19:03:34.645Z" gives back an "Invalid date" error in Cloudwatch Log Insights.

Does anyone know what is required to parse/cast timestamps that appear within your logs so they can be used with the built-in date/time functions?

My end goal is to compare a timestamp that appears within my logs with the built-in @ingestionTime field.

Answer 1

Just came cross on this. Not sure if you already found your answer. You got "Invalid date" because "date_floor" function requires type of Timestamp, not String type. Nonetheless, I don't see any Datetime functions that can construct Timestamp from a String in AWS Cloudwatch User Guide even today. One option is to use epoch time (number) and convert it to Timestamp by using fromMillis(epoch).