Cloud9
.Logs
, click on Insights
.Select log group(s)
drop down, select the ecs/PetListAdoptions
log group.Note: you can select more than one log group. As of May 2020, you can select up to 20 log groups at a time.
You will see that a sample query is automatically placed in the query field.
Run query
and view the results.The sample query fetches the
@timestamp
and@message
fields from the log data, orders by the timestamp field in descending order and, displays the first 20 records.
You can learn more about Logs Insights syntax and queries here.
The following query applies a filter on the messages and fetches only the records that contain the string
brown
in the log.
fields @timestamp, @message
| sort @timestamp desc
| limit 20
| filter @message like /brown/
run query
.The are results ordered by the timestamp field and displayed in descending order.
The following query returns a result that contains the number of messages captured by in minute intervals
fields @timestamp, @message
| stats count(@message) as number_of_events by bin(5m)
| limit 20
You can also visualize the results by clicking on the Visualization
tab in the results area as shown below.
Notice that you can also add the visualization to a CloudWatch Dashboard, export to csv and so on.
You can also query log groups using the AWS CLI.
CloudShell
.The query below queries the top 10 log records from a log group for a specific time period.
You may need to update the start and end time parameter values to the right epoch time values. You can calculate epoch time values from this public website - https://www.epochconverter.com/
aws logs start-query --log-group-name /ecs/PetListAdoptions --start-time '1588645795' --end-time '1591324195' --query-string 'fields @message | limit 10'
The above query will return a queryId.
<QUERY_ID>
with the query ID that you copied from the result and execute the command below in the terminal:aws logs get-query-results --query-id <QUERY_ID>
If no logs were returned, use the website in the orange info alert above to update the epoch time values and try again.
This concludes this section. You may continue on to the next section.