query aws loginsight from clojure

aws-loginsight-query.clj

(require
  '[clj-http.client :as client]
  '[clojure.java.shell :refer [sh]]
  '[clojure.string :as s]
  '[taoensso.timbre :as log]
  '[taoensso.timbre.appenders.core :as appenders])
  
(defn- aws-logs-start-query
  "Starts a aws logs query, returns the query-id"
  [{:keys [log-group-names start-time end-time query-string limit]
    :or   {end-time   (System/currentTimeMillis)
           start-time (- (System/currentTimeMillis) (* 24 3600 1000))
           limit      100}}]
  {:pre [query-string (seq log-group-names)]}
  (let [query-string (if (sequential? query-string)
                       (s/join " " query-string)
                       query-string)
        cmd (concat
              ["aws" "logs" "start-query" "--start-time" (str start-time) "--end-time" (str end-time) "--query-string" query-string "--limit" (str limit) "--log-group-names"]
              log-group-names)
        {:keys [err out exit]} (apply sh cmd)]
    (log/debug (s/join " " cmd))
    (if (zero? exit)
      (parse-string out true)
      (throw (ex-info err {:cmd cmd})))))

(defn- aws-logs-get-query-results
  "Get query result by query-id, poll to wait for the query to complete"
  ([query-id]
   (aws-logs-get-query-results query-id 1000))
  ([query-id poll-time]
   (let [cmd ["aws" "logs" "get-query-results" "--query-id" query-id]
         {:keys [err out exit]} (apply sh cmd)]
     (if (zero? exit)
       (let [{:keys [status] :as r} (parse-string out true)]
         (if (= status "Running")
           (do
             (Thread/sleep poll-time)
             (recur query-id poll-time))
           r))
       (throw (ex-info err {:cmd cmd}))))))

(defn aws-logs-query
  "Run a query and wait to get the results. For parameters please refer to `aws-logs-start-query`"
  [query-map]
  (some->>
    (aws-logs-start-query query-map)
    (:queryId)
    (aws-logs-get-query-results)))

Usage

(def start-time (* 1000 (.toEpochSecond (ZonedDateTime/of 2022 12 9 0 0 0 0 (ZoneId/of "GMT")))))
(def end-time   (* 1000 (.toEpochSecond (ZonedDateTime/of 2022 12 10 0 0 0 0 (ZoneId/of "GMT")))))

(aws-logs-query {:log-group-names [""]
                 :limit           10000
                 :start-time      start-time
                 :end-time        end-time
                 :query-string    "fields @timestamp, requestTime, httpMethod as method, path, requestId, responseLatency as latency, status | sort @timestamp desc |filter status=503"})