Amazon CloudWatch Logs
用户指南
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅 Amazon AWS 入门

查询示例

本部分包含的示例查询显示 CloudWatch Logs Insights 的强大功能。

常规查询

查找 25 个最近添加的日志事件:

fields @timestamp, @message | sort @timestamp desc | limit 25

获得每小时异常数量的列表:

filter @message like /Exception/ | stats count(*) as exceptionCount by bin(1h) | sort exceptionCount desc

获取并非异常的日志事件的列表:

fields @message | filter @message not like /Exception/

筛选命令示例

要将

查询用于 Lambda 日志

确定超额配置的内存量:

filter @type = "REPORT" | stats max(@memorySize / 1024 / 1024) as provisonedMemoryMB, min(@maxMemoryUsed / 1024 / 1024) as smallestMemoryRequestMB, avg(@maxMemoryUsed / 1024 / 1024) as avgMemoryUsedMB, max(@maxMemoryUsed / 1024 / 1024) as maxMemoryUsedMB, provisonedMemoryMB - maxMemoryUsedMB as overProvisionedMB

创建延迟报告:

filter type = "REPORT" | stats avg(@duration), max(@duration), min(@duration) by bin(5m)

查询用于 Amazon VPC 流日志

查找跨主机的前 15 个数据包传输:

stats sum(packets) as packetsTransferred by srcAddr, dstAddr | sort packetsTransferred desc | limit 15

查找给定主机的前 20 个字节传输:

filter srcAddr= "192.0.2.0/24" | stats sum(bytes) as bytesTransferred by dstAddr | sort bytesTransferred desc | limit 15

使用 UDP 作为数据传输协议查找 IP 地址:

filter protocol=17 | stats count(*) by srcAddr

在捕获时段内查找跳过流记录的 IP 地址:

filter logStatus="SKIPDATA" | stats count(*) by bin(1h) as t | sort t

查询用于 Route 53 日志

查找每小时每种查询类型的记录分布:

stats count(*) by queryType, bin(1h)

查找具有最高请求数的 10 个 DNS 解析程序:

stats count(*) as numRequests by resolverIp | sort numRequests desc | limit 10

按服务器未能完成 DNS 请求的域和子域查找记录数:

filter responseCode="SERVFAIL" | stats count(*) by queryName

查询用于 CloudTrail 日志

查找每项服务、事件类型和区域的日志条目数:

stats count(*) by eventSource, eventName, awsRegion

找到给定区域中已启动或已停止的 Amazon EC2 主机:

filter (eventName="StartInstances" or eventName="StopInstances") and region="us-east-2"

查找新建的 IAM 用户的区域、用户名和 ARN:

filter eventName="CreateUser" | fields awsRegion, requestParameters.userName, responseElements.user.arn

查找在调用 API UpdateTrail 时发生异常的记录数:

filter eventName="UpdateTrail" and ispresent(errorCode) | stats count(*) by errorCode, errorMessage