In this article, I am introduction query and search cloudwatch insights basic.

APIGW

• statistical according api key id

fields @timestamp, @message
| filter @message like /API Key ID/
| parse @message "API Key ID: *" as @apikeyid
| stats count(*) by @apikeyid

• statistical call according ip

fields @timestamp, @message
| filter @message like /X-Forwarded-For/
| parse @message "X-Forwarded-For=*," as @apikeyid
| stats count(*) as tmp by @apikeyid
| sort tmp desc

• statistical call according path

fields @timestamp, @message
| filter @message like /Resource Path/
| parse @message "Resource Path: *" as @apipath
| stats count(*) as tmp by @apipath
| sort tmp desc

• statistical call according domain

fields @timestamp, @message
| filter @message like /Host/
| parse @message "Host=*," as @apipath
| stats count(*) as tmp by @apipath
| sort tmp desc

• sort latency

fields @timestamp, @message, @logStream, @log, latency
| sort latency desc
| limit 20

• max, min, avg latency

fields @timestamp, @message, @logStream, @log, latency
| max(latency) as max, min(latency) as min, avg(latency)

• filter latency

fields @timestamp, @message, @logStream, @log, latency
| filter latency > 1000

• filter status, http code

fields @timestamp, @message, @logStream, @duration 
| filter @message like 'status":"500"'
| filter @message like 'pathName'
| sort @timestamp desc

and pathName is the router, ex: auth/login

lambda

• memory usage

filter @type = "REPORT"
| stats max(@memorySize / 1000 / 1000) as provisionedMemoryMB,
  min(@maxMemoryUsed / 1000 / 1000) as smallestMemoryRequestMB,
  avg(@maxMemoryUsed / 1000 / 1000) as avgMemoryUsedMB,
  max(@maxMemoryUsed / 1000 / 1000) as maxMemoryUsedMB,
  provisionedMemoryMB - maxMemoryUsedMB as overProvisionedMB

• latency lambda

filter @type = "REPORT"
| fields @requestId, @billedDuration, @logStream, @duration
| sort by @billedDuration desc

REPORT RequestId: 56ca8bba-aa7d-4585-b4d6-5aa53651349a Duration: 93.16 ms Billed Duration: 94 ms Memory Size: 512 MB Max Memory Used: 60 MB

Contacts

• facebook: https://www.facebook.com/phucducdev/

• gmail: ducnp09081998@gmail.com

• linkedin: https://www.linkedin.com/in/phucducktpm/

• hashnode: https://hashnode.com/@OpenDev

• telegram: https://t.me/OpenDevGolang