Amazon CloudWatch Logs Insights now supports a new lookup command that enables customers to enrich log query results with data from reference tables. Developers, DevOps engineers, and SREs working with complex distributed systems often encounter logs containing opaque identifiers such as GUIDs, IP addresses, or internal resource IDs that are difficult to interpret without additional context.

With the lookup command, you can join log data against a lookup table at query time, automatically enriching your results with meaningful values. For example, you can translate a customer ID into a customer name or map an internal IP address to the team that owns it. The new command makes log analysis faster and more intuitive without requiring pre-processing pipelines. 

The lookup command is available today in all commercial AWS Regions. 

To get started, upload a CSV file by navigating to CloudWatch → Settings → Logs.  Next, use the lookup command in your Logs Insights queries by specifying a log field, a lookup table name, and one or more columns.  CSV data does not count toward CloudWatch Logs Insights per GB of data scanned query charges.  To learn more, see the CloudWatch Logs Insights documentation.