Monitoring with CloudWatch metrics - Amazon CloudWatch Logs
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Monitoring with CloudWatch metrics

CloudWatch Logs sends metrics to Amazon CloudWatch every minute.

CloudWatch Logs metrics

The AWS/Logs namespace includes the following metrics.

Metric Description

CallCount

The number of specified API operations performed in your account.

CallCount is a CloudWatch Logs service usage metric. For more information, see CloudWatch Logs service usage metrics.

Valid Dimensions: Class, Resource, Service, Type

Valid Statistic: Sum

Units: None

DeliveryErrors

The number of log events for which CloudWatch Logs received an error when forwarding data to the subscription destination. If the destination service returns a retryable error such as a throttling exception or a retryable service exception (HTTP 5xx for example), CloudWatch Logs continues to retry delivery for up to 24 hours. CloudWatch Logs does not try to re-deliver if the error is a non-retryable error, such as AccessDeniedException or ResourceNotFoundException.

Valid Dimensions: LogGroupName, DestinationType, FilterName, PolicyLevel

Valid Statistic: Sum

Units: None

DeliveryThrottling

The number of log events for which CloudWatch Logs was throttled when forwarding data to the subscription destination.

If the destination service returns a retryable error such as a throttling exception or a retryable service exception (HTTP 5xx for example), CloudWatch Logs continues to retry delivery for up to 24 hours. CloudWatch Logs does not try to re-deliver if the error is a non-retryable error, such as AccessDeniedException or ResourceNotFoundException.

Valid Dimensions: LogGroupName, DestinationType, FilterName, PolicyLevel

Valid Statistic: Sum

Units: None

EMFParsingErrors

The number of parsing errors encountered while processing embedded metric format logs. Such errors happen when logs are identified as embedded metric format but do not follow the correct format. For more information about the embedded metric format, see Specification: Embedded metric format.

Valid Dimensions: LogGroupName

Valid Statistic: Sum

Units: None

EMFValidationErrors

The number of validation errors encountered while processing embedded metric format logs. These errors occur when metric definitions within embedded metric format logs do not adhere to the embedded metric format and MetricDatum specifications. For information about the CloudWatch embedded metric format, see Specification: Embedded metric format. For information about the data type MetricDatum, see MetricDatum in the Amazon CloudWatch API Reference.

Note

Certain validation errors can lead to multiple metrics within an EMF log not being published. For example, all metrics set with an invalid namespace will be dropped.

Valid Dimensions: LogGroupName

Valid Statistic: Sum

Units: None

ErrorCount

The number of API operations performed in your account that resulted in errors.

ErrorCount is a CloudWatch Logs service usage metric. For more information, see CloudWatch Logs service usage metrics.

Valid Dimensions: Class, Resource, Service, Type

Valid Statistic: Sum

Units: None

ForwardedBytes

The volume of log events in compressed bytes forwarded to the subscription destination.

Valid Dimensions: LogGroupName, DestinationType, FilterName

Valid Statistic: Sum

Units: Bytes

ForwardedLogEvents

The number of log events forwarded to the subscription destination.

Valid Dimensions: LogGroupName, DestinationType, FilterName, PolicyLevel

Valid Statistic: Sum

Units: None

IncomingBytes

The volume of log events in uncompressed bytes uploaded to CloudWatch Logs. When used with the LogGroupName dimension, this is the volume of log events in uncompressed bytes uploaded to the log group.

Valid Dimensions: LogGroupName

Valid Statistic: Sum

Units: Bytes

IncomingLogEvents

The number of log events uploaded to CloudWatch Logs. When used with the LogGroupName dimension, this is the number of log events uploaded to the log group.

Valid Dimensions: LogGroupName

Valid Statistic: Sum

Units: None

LogEventsWithFindings

The number of log events that matched a data string that you are auditing using the CloudWatch Logs data protection feature. For more information, see Help protect sensitive log data with masking.

Valid Dimensions: None

Valid Statistic: Sum

Units: None

ThrottleCount

The number of API operations performed in your account that were throttled because of usage quotas.

ThrottleCount is a CloudWatch Logs service usage metric. For more information, see CloudWatch Logs service usage metrics.

Valid Dimensions: Class, Resource, Service, Type

Valid Statistic: Sum

Units: None

Dimensions for CloudWatch Logs metrics

The dimensions that you can use with CloudWatch Logs metrics are listed in the following table.

Dimension Description
LogGroupName

The name of the CloudWatch Logs log group for which to display metrics.

DestinationType

The subscription destination for the CloudWatch Logs data, which can be Amazon Lambda, Amazon Kinesis Data Streams, or Amazon Data Firehose.

FilterName

The name of the subscription filter that is forwarding data from the log group to the destination. The subscription filter name is automatically converted by CloudWatch to ASCII and any unsupported characters get replaced with a question mark (?).

The dimensions for metrics related to account-level subscription filters are listed in the following table.

Dimension Description
PolicyLevel

The level where the policy applies. Currently, the only valid value for this dimension is AccountPolicy

DestinationType

The subscription destination for the CloudWatch Logs data, which can be Amazon Lambda, Amazon Kinesis Data Streams, or Amazon Data Firehose.

FilterName

The name of the subscription filter that is forwarding data from the log group to the destination. The subscription filter name is automatically converted by CloudWatch to ASCII and any unsupported characters get replaced with a question mark (?).

CloudWatch Logs service usage metrics

CloudWatch Logs sends metrics to CloudWatch that track the usage CloudWatch Logs API operations. These metrics correspond to Amazon service quotas. Tracking these metrics can help you proactively manage your quotas. For more information, see Service Quotas Integration and Usage Metrics.

For example, you could track the ThrottleCount metric or set an alarm on that metric. If the value of this metric rises, you should consider requesting a quota increase for the API operation that is getting throttled. For more information about CloudWatch Logs service quotas, see CloudWatch Logs quotas.

CloudWatch Logs publishes service quota usage metrics every minute in both the AWS/Usage and AWS/Logs namespaces.

The following table lists the service usage metrics published by CloudWatch Logs. These metrics do not have a specified unit. The most useful statistic for these metrics is SUM, which represents the total operation count for the 1-minute period.

Each of these metrics is published with values for all of the Service, Class, Type, and Resource dimensions. They are also published with a single dimension called Account Metrics. Use the Account Metrics dimension to see the sum of metrics for all API operations in your account. Use the other dimensions and specify the name of an API operation for the Resource dimension to find the metrics for that particular API.

Metrics

Metric Description

CallCount

The number of specified operations performed in your account.

CallCount is published in both the AWS/Usage and AWS/Logs namespaces.

ErrorCount

The number of API operations performed in your account that resulted in errors.

ErrorCount is published in only the AWS/Logs.

ThrottleCount

The number of API operations performed in your account that were throttled because of usage quotas.

ThrottleCount is published in only the AWS/Logs.

Dimensions

Dimension Description

Account metrics

Use this dimension to get a sum of the metric across all of the CloudWatch Logs APIs.

If you want to see the metrics for one particular API, use the other dimensions listed in this table and specify the API name as the value of Resource.

Service

The name of the Amazon service containing the resource. For CloudWatch Logs usage metrics, the value for this dimension is Logs.

Class

The class of resource being tracked. CloudWatch Logs API usage metrics use this dimension with a value of None.

Type

The type of resource being tracked. Currently, when the Service dimension is Logs, the only valid value for Type is API.

Resource

The name of the API operation. Valid values include all of the API operation names that are listed in Actions. For example, PutLogEvents