Query AWS CloudWatch Logs Insights through the CLI

The following will query CloudWatch Logs Insights for last 24 hours. If you want to search for a different duration, adjust the --start-time and --end-time parameters accordingly.

queryId=$(aws logs start-query \
    --log-group-name '<log-group-name>' \
    --start-time `date -j -v-1d +%s` \
    --end-time `date +%s` \
    --query-string '
        fields @timestamp, @message
        | sort @timestamp desc
        | limit 20
    ' | jq --raw-output '.queryId'
)
aws logs get-query-results \
    --query-id $queryId