1. Syslog Query

Cloudwatch Insight에서 Query하여 Log stream을 분석할 수 있습니다. 간단한 Query 구문을 분석해봅니다.

PARSE @message "* * * * *: *" as a, b, c, Hosts, Service, States
| fields concat(a, ' ', b, ' ', c) as Dates
| display Dates, Hosts, Service, States
| limit 5

메세지 예시를 통해 Query를 가볍게 살펴보겠습니다. 

Apr 13 16:19:14 STG systemd[2040]: Reached target Basic System.
PARSE @message "* * * * *: *" as a, b, c, Hosts, Service, States
| fields concat(a, ' ', b, ' ', c) as Dates
| display Dates, Hosts, Service, States
| limit 5

2. Syslog Query (Filter)

PARSE @message "* * * * *: *" as a, b, c, Hosts, Service, States
| fields concat(a, ' ', b, ' ', c) as Dates
| filter (States =~ /(?i)cannot/ or States =~ /(?i)fail/)
| display Dates, Hosts, Service, States
| limit 20

Filter 구문을 활용하면, 필요한 레코드만 출력할 수 있습니다.

[AWS] Cloudwatch Insight Query Example