yes it can, if you tag your log stream correctly - either by having the stream externally tagged via attributes, or internally by following certain conventions

yes it can, if you tag your log stream correctly - either by having the stream externally tagged via attributes, or internally by following certain conventions in the log line. You can also do something like select client_ip from requests where elapsed_ms > 10000 which is incredibly powerful