Contributor Insights 规则示例 - Amazon CloudWatch
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 AWS 服务入门

如果我们为英文版本指南提供翻译,那么如果存在任何冲突,将以英文版本指南为准。在提供翻译时使用机器翻译。

Contributor Insights 规则示例

此部分包含的示例说明了 Contributor Insights 规则的使用案例。

VPC 流日志 按来源和目标IP地址的协议转移

{ "Schema": { "Name": "CloudWatchLogRule", "Version": 1 }, "LogGroupNames": [ "/aws/containerinsights/sample-cluster-name/flowlogs" ], "LogFormat": "CLF", "Fields": { "4": "srcaddr", "5": "dstaddr", "10": "bytes" }, "Contribution": { "Keys": [ "srcaddr", "dstaddr" ], "ValueOf": "bytes", "Filters": [] }, "AggregateOn": "Sum" }

VPC 流日志 最多的HTTPS请求数

{ "Schema": { "Name": "CloudWatchLogRule", "Version": 1 }, "LogGroupNames": [ "/aws/containerinsights/sample-cluster-name/flowlogs" ], "LogFormat": "CLF", "Fields": { "5": "destination address", "7": "destination port", "9": "packet count" }, "Contribution": { "Keys": [ "destination address" ], "ValueOf": "packet count", "Filters": [ { "Match": "destination port", "EqualTo": 443 } ] }, "AggregateOn": "Sum" }

VPC 流日志 拒绝的TCP连接

{ "Schema": { "Name": "CloudWatchLogRule", "Version": 1 }, "LogGroupNames": [ "/aws/containerinsights/sample-cluster-name/flowlogs" ], "LogFormat": "CLF", "Fields": { "3": "interfaceID", "4": "sourceAddress", "8": "protocol", "13": "action" }, "Contribution": { "Keys": [ "interfaceID", "sourceAddress" ], "Filters": [ { "Match": "protocol", "EqualTo": 6 }, { "Match": "action", "In": [ "REJECT" ] } ] }, "AggregateOn": "Sum" }

Route 53 按来源地址的NEXDomain回答

{ "Schema": { "Name": "CloudWatchLogRule", "Version": 1 }, "AggregateOn": "Count", "Contribution": { "Filters": [ { "Match": "$.rcode", "StartsWith": [ "NXDOMAIN" ] } ], "Keys": [ "$.srcaddr" ] }, "LogFormat": "JSON", "LogGroupNames": [ "<loggroupname>" ] }

Route 53 按域名解析查询

{ "Schema": { "Name": "CloudWatchLogRule", "Version": 1 }, "AggregateOn": "Count", "Contribution": { "Filters": [], "Keys": [ "$.query_name" ] }, "LogFormat": "JSON", "LogGroupNames": [ "<loggroupname>" ] }

Route 53 按查询类型和源地址的解析器查询

{ "Schema": { "Name": "CloudWatchLogRule", "Version": 1 }, "AggregateOn": "Count", "Contribution": { "Filters": [], "Keys": [ "$.query_type", "$.srcaddr" ] }, "LogFormat": "JSON", "LogGroupNames": [ "<loggroupname>" ] }