Use the query language and StartQuery/GetQueryResults APIs you can get filtering and sorting and way more. Reference: https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html