View a markdown version of this page

outlier - Amazon CloudWatch Logs
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

outlier

Use the outlier command to detect statistical outliers in numeric fields based on the interquartile range (IQR). You can remove or clamp outlier rows.

Syntax

| outlier [action=remove|transform] [param=n] [uselower=true|false] [mark=true|false] field [field ...]

The command uses the following arguments:

  • action (Optional) – Either remove (drops outlier rows) or transform (clamps to boundary). Default: transform.

  • param (Optional) – The IQR multiplier. Default: 2.5.

  • uselower (Optional) – Whether to detect lower-bound outliers. Default: false.

  • mark (Optional) – Whether to add a boolean marker field. Default: false.

  • field – One or more numeric fields to check for outliers.

Example

The following query removes rows where cpu or memory are outliers, using a 3.0 IQR multiplier with lower-bound detection and marking.

fields @timestamp, cpu, memory
| outlier action=remove param=3.0 uselower=true mark=true cpu memory