Where is the cloudwatch logs query syntax actually doccumented?