It baffles me that CloudWatch still does not support this basic operation. We had to add epoch timestamps to our logs and compare them instead.