CloudWatch search expression examples - Amazon CloudWatch
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

CloudWatch search expression examples

The following examples illustrate more search expression uses and syntax. Let's start with a search for CPUUtilization across all instances in the Region and then look at variations.

This example displays one line for each instance in the Region, showing the CPUUtilization metric from the AWS/EC2 namespace.

SEARCH(' {AWS/EC2,InstanceId} MetricName="CPUUtilization" ', 'Average')

Changing InstanceId to InstanceType changes the graph to show one line for each instance type used in the Region. Data from all instances of each type is aggregated into one line for that instance type.

SEARCH(' {AWS/EC2,InstanceType} MetricName="CPUUtilization" ', 'Average')

The following example aggregates the CPUUtilization by instance type and displays one line for each instance type that includes the string micro.

SEARCH('{AWS/EC2,InstanceType} InstanceType=micro MetricName="CPUUtilization" ', 'Average')

This example narrows the previous example, changing the InstanceType to an exact search for t2.micro instances.

SEARCH('{AWS/EC2,InstanceType} InstanceType="t2.micro" MetricName="CPUUtilization" ', 'Average')

The following search removes the {metric schema} part of the query, so the CPUUtilization metric from all namespaces appears in the graph. This can return quite a few results because the graph includes multiple lines for the CPUUtilization metric from each Amazon service, aggregated along different dimensions.

SEARCH('MetricName="CPUUtilization" ', 'Average')

To narrow these results a bit, you can specify two specific metric namespaces.

SEARCH('MetricName="CPUUtilization" AND ("AWS/ECS" OR "AWS/ES") ', 'Average')

The preceding example is the only way to do a search of specific multiple namespaces with one search query, as you can specify only one metric schema in each query. However, to add more structure, you could use two queries in the graph, as in the following example. This example also adds more structure by specifying a dimension to use to aggregate the data for Amazon ECS.

SEARCH('{AWS/ECS ClusterName}, MetricName="CPUUtilization" ', 'Average') SEARCH(' {AWS/EBS} MetricName="CPUUtilization" ', 'Average')

The following example returns the Elastic Load Balancing metric named ConsumedLCUs as well as all Elastic Load Balancing metrics or dimensions that contain the token flow.

SEARCH('{AWS/NetworkELB, LoadBalancer} "ConsumedLCUs" OR flow ', 'Maximum')

The following example uses nested grouping. It returns Lambda metrics for Errors from all functions and Invocations of functions with names that include the strings ProjectA or ProjectB.

SEARCH('{AWS/Lambda,FunctionName} MetricName="Errors" OR (MetricName="Invocations" AND (ProjectA OR ProjectB)) ', 'Average')

The following example displays all of your custom metrics, excluding metrics generated by Amazon services.

SEARCH('NOT Namespace=AWS ', 'Average')

The following example displays metrics with metric names, namespaces, dimension names, and dimension values that contain the string Errors as part of their name.

SEARCH('Errors', 'Average')

The following example narrows that search to exact matches. For example, this search finds the metric name Errors but not metrics named ConnectionErrors or errors.

SEARCH(' "Errors" ', 'Average')

The following example shows how to specify names that contain spaces or special characters in the metric schema part of the search term.

SEARCH('{"Custom-Namespace", "Dimension Name With Spaces"}, ErrorCount ', 'Maximum')

CloudWatch cross-account observability search expression examples

CloudWatch cross-account observability examples

If you are signed in to an account that is set up as a monitoring account in CloudWatch cross-account observability, you can use the SEARCH function to return metrics from specified source accounts. For more information, see CloudWatch cross-account observability.

The following example retrieves all Lambda metrics from the account with the account ID 111122223333.

SEARCH(' AWS/Lambda :aws.AccountId = "111122223333" ', 'Average')

The following example retrieves all AWS/EC2 metrics from two accounts: 111122223333 and 777788889999.

SEARCH(' AWS/EC2 :aws.AccountId = ("111122223333" OR "777788889999") ', 'Average')

The following example retrieves all AWS/EC2 metrics from the source account 111122223333 and from the monitoring account itself.

SEARCH(' AWS/EC2 :aws.AccountId = ("111122223333" OR 'LOCAL') ', 'Average')

The following example retrieves the SUM of the MetaDataToken metric from the account 444455556666 with the InstanceId dimension.

SEARCH('{AWS/EC2,InstanceId} :aws.AccountId=444455556666 MetricName=\"MetadataNoToken\"','Sum')