Calculate Lambda function invocation duration from logs

Problem / Use case

You want to measure how long each AWS Lambda function invocation took by calculating the time difference between the first and last log entry per invocation. This is useful for debugging, performance tuning, or anomaly detection.

Query

source logs
| filter cx_metadata.faas_name != null
| groupby cx_metadata.faas_name as lambda_function, cx_metadata.faas_execution as invocation_id agg
   formatTimestamp(min($m.timestamp), 'timestamp_milli') as start,
   formatTimestamp(max($m.timestamp), 'timestamp_milli') as end
| create duration_ms from end:number - start:number

Expected output

lambda_function	invocation_id	start	end	duration_ms
cll-lambda-nodejs	<UUID>	1751177380361	1751177381308	947
cll-lambda-nodejs	<UUID>	1751177269953	1751177270800	847
cll-lambda-nodejs	<UUID>	1751177740317	1751177741183	866
cll-lambda-python	<UUID>	1751176967341	1751176971141	3800
cll-lambda-python-2	<UUID>	1751177161241	1751177162766	1525
cll-lambda-python-2	<UUID>	1751177148528	1751177150003	1475
continuousdataflowfunction-faas	<UUID>	1751177722174	1751177782589	60415
databaserelatederrorsfunction-faas	<UUID>	1751177242395	1751177243685	1290
...

Variations

Aggregate durations per Lambda function

Once you’ve calculated the duration of each Lambda function invocation, you might want to summarize performance across all invocations of a given function. This helps answer questions like:

• Which Lambda function runs the longest on average?
• What’s the total compute time per function?
• Are there outliers or performance spikes?

Add this to the end of the query:

| groupby lambda_function aggregate
   sum(duration_ms).round(2) as total_duration_ms,
   avg(duration_ms).round(2) as avg_duration_ms,
   percentile(0.95, duration_ms).round(2) as p95_duration_ms

lambda_function	total_duration_ms	avg_duration_ms	p95_duration_ms
cll-lambda-nodejs	34936	919.37	1162
cll-lambda-python	57323	3821.53	4350.5
cll-lambda-python-2	727061	31611.35	192047.73
continuousdataflowfunction-faas	786910	56207.86	60589.4
databaserelatederrorsfunction-faas	3700	264.29	306
...

TL;DR

Use diffTime on grouped timestamps to calculate Lambda function execution duration. Optionally roll up by function name for summaries.