Use AWS CLI to query AWS CloudWatch Logs and determine the most recent entry into a Log Group

cwl-last-used.sh

aws logs describe-log-groups | jq ".logGroups[].logGroupName" | grep -E "homeplus|mcdonalds" | xargs -n 1 -t aws logs describe-log-streams --query "logStreams[*].lastEventTimestamp" --log-group | jq "max/1000|floor" | xargs -t -n 1 date -r

# aws logs describe-log-groups | jq ".logGroups[].logGroupName" 
# Get LogGroup names

# grep -E "homeplus|mcdonalds" 
# (Optional) Filter LogGroup names

# xargs -n 1 -t aws logs describe-log-streams --query "logStreams[*].lastEventTimestamp" --log-group | jq "max/1000|floor"
# Get last event timestamp for each LogGroup. 
# (Optional) Convert milliseconds timestamp to seconds timestamp.

# xargs -t -n 1 date -r
# (MacOS X) Format seconds timestamp into human-readable format.
# (Other) Change `date -r` to `date -d` or other option appropriate to the installation of `date` included with your OS

# BONUS: After verifying LogGroups as old/unused delete them
# aws logs describe-log-groups | jq ".logGroups[].logGroupName" | grep -E "homeplus|mcdonalds" | grep -v "mcdonalds-v1-production" | xargs -n 1 -p aws logs delete-log-group --log-group-name

# grep -v "mcdonalds-v1-production" 
# (Optional) Filter rule to excluded any LogGroups that should be kept.

# xargs -n 1 -p aws logs delete-log-group --log-group-name
# The -p option specifies that xargs should prompt for user confirmation before each command execution.