AWS Cloudwatch Insights Cheatsheet

1# Count occurences of a string
2```
3fields @timestamp, @message, kubernetes.labels.app
4| filter kubernetes.labels.app like 'synch-api'
5| sort @timestamp asc
6| filter @message  like '"GET'
7#| filter @message not like '"GET / HTTP/1.1\" 200'
8| filter @message not like 'GET /health HTTP/1.1'
9| filter @message not like 'UnauthorizedError'
10| filter log not like '"GET / HTTP/1.1" 200'
11# | filter @timestamp < 2000
12# | filter @message not like 'kube-probe'
13| filter @message not like 'Error'
14| filter @message not like '500'
15| filter @message not like '404'
16| filter @message not like '400'
17| filter @logStream like 'synch-api-staging'
18#
19| parse @message "GET * HTTP/1.1" as nuno_url
20| stats count(*) as counter by nuno_url  
21| sort  counter desc
22| limit 30
23```
24
25# Simple query to find by regex
26```
27fields @timestamp, @message
28| filter kubernetes.labels.app = 'api-staging'
29| sort @timestamp asc
30| filter @message not like 'kube-probe'
31# | filter @message like 'HTTP/1.1\" 500'
32| filter @logStream like 'my-pod-c1352ada194103f3683af65681ebba0523813d979cc307c292a516ef072570a'
33| limit 200
34```
35