Skip to content

Calculate Lambda invocation duration from logs

Problem / use case

You want to measure how long each AWS Lambda invocation took by calculating the time difference between the first and last log entry per invocation. This is useful for debugging, performance tuning, or anomaly detection.

Query

source logs
| filter cx_metadata.faas_name != null
| groupby cx_metadata.faas_name as lambda, cx_metadata.faas_execution as invocation_id agg
   min($m.timestamp) as start,
   max($m.timestamp) as end
| create duration from end.diffTime(start)

Expected output

Lambdaexecution_idLogsStartEndDuration
MalfunctioningDatabaseFunction-faas01362d6d-3ec2-43ae-9bfb-366b7bc84242509/06/2025 18:39:22.44309/06/2025 18:39:22.671228000000
MalfunctioningDatabaseFunction-faas4d905e36-4d26-40b5-8c78-40ddd0237839409/06/2025 18:40:22.23609/06/2025 18:40:22.451214000000
OverloadSpecificTableFunction-faasb8819ae0-eb17-423b-80db-5fd57bbabda01309/06/2025 18:39:22.38409/06/2025 18:39:27.8325448000000
OverloadSpecificTableFunction-faas2706b0fb-4620-4582-9c2d-3ab5f21281ba1309/06/2025 18:40:22.20809/06/2025 18:40:27.6805471000000
cll-lambda-nodejsf657c430-1d6e-4b8c-8b16-b48e42f1f26a1209/06/2025 18:39:49.91509/06/2025 18:39:50.760846000000
cll-lambda-nodejsf5e9129d-3d05-4a36-beeb-7f8123fa8ddf1209/06/2025 18:40:40.25609/06/2025 18:40:41.3231067000000
FetchCustomerHistoryFromRDS-faas6c378aa1-74c5-5a4c-8f3a-ea60752621e3709/06/2025 18:37:22.81609/06/2025 18:37:25.4942678000000

Variations

Aggregate durations per Lambda function

Once you’ve calculated the duration of each Lambda invocation, you might want to summarize performance across all invocations of a given function. This helps answer questions like:

  • Which Lambda runs the longest on average?
  • What’s the total compute time per function?
  • Are there outliers or performance spikes?

Add this to the end of the query:

| groupby lambda aggregate
   sum(duration) as total_duration,
   avg(duration) as avg_duration,
   percentile(0.95, duration) as p95_duration
LambdaSum_ExecAvg_ExecP95
cll-lambda-python-23d20h51m24s364ms22s116ms67us3m1s908ms781us
cll-lambda-python10h37m37s194ms3s796ms863us4s558ms248us
cll-lambda-nodejs-26d22h53m35s245ms1m59s233ms31us2s403ms508us
cll-lambda-nodejs5d8h23m58s417ms18s349ms347us1s338ms689us
OverloadSpecificTableFunction-faas15h20m52s575ms5s483ms582us5s536ms666us
NotifyProcessingAndTriggerWorkflow-faasavion14h36m38s885ms425ms282us566ms672us
NotifyProcessingAndTriggerWorkflow-faas38m3s257ms369ms160us482ms76us

TL;DR

Use diffTime on grouped timestamps to calculate Lambda execution duration. Optionally roll up by function name for summaries.