Calculate Lambda function invocation duration from logs

Problem / use case

You want to measure how long each AWS Lambda function invocation took by calculating the time difference between the first and last log entry per invocation. This is useful for debugging, performance tuning, or anomaly detection.

Query

source logs
| filter cx_metadata.faas_name != null
| groupby cx_metadata.faas_name as lambda_function, cx_metadata.faas_execution as invocation_id agg
   formatTimestamp(min($m.timestamp), 'timestamp_milli') as start,
   formatTimestamp(max($m.timestamp), 'timestamp_milli') as end
| create duration_ms from end:number - start:number

Expected output

Variations

Aggregate durations per Lambda function

Once you’ve calculated the duration of each Lambda function invocation, you might want to summarize performance across all invocations of a given function. This helps answer questions like:

• Which Lambda function runs the longest on average?
• What’s the total compute time per function?
• Are there outliers or performance spikes?

Add this to the end of the query:

| groupby lambda_function aggregate
   sum(duration_ms).round(2) as total_duration_ms,
   avg(duration_ms).round(2) as avg_duration_ms,
   percentile(0.95, duration_ms).round(2) as p95_duration_ms

TL;DR

Use diffTime on grouped timestamps to calculate Lambda function execution duration. Optionally roll up by function name for summaries.