Use natural language to query Amazon CloudWatch logs and metrics (preview)

To make it straightforward to work together together with your operational knowledge, Amazon CloudWatch is introducing at present pure language question era for Logs and Metrics Insights. With this functionality, powered by generative synthetic intelligence (AI), you may describe in English the insights you might be on the lookout for, and a Logs or Metrics Insights question will probably be mechanically generated.

This characteristic supplies three important capabilities for CloudWatch Logs and Metrics Insights:

• Generate new queries from an outline or a query that will help you get began simply.
• Question rationalization that will help you be taught the language together with extra superior options.
• Refine present queries utilizing guided iterations.

Let’s see how these work in apply with a number of examples. I’ll cowl logs first after which metrics.

Generate CloudWatch Logs Insights queries with pure language
Within the CloudWatch console, I choose Log Insights within the Logs part. I then choose the log group of an AWS Lambda perform that I need to examine.

I select the Question generator button to open a brand new Immediate discipline the place I enter what I would like utilizing pure language:

Inform me the length of the 10 slowest invocations

Then, I select Generate new question. The next Log Insights question is mechanically generated:

fields @timestamp, @requestId, @message, @logStream, @length 
| filter @sort = "REPORT" and @length > 1000
| type @length desc
| restrict 10

I select Run question to see the outcomes.

I discover that now there’s an excessive amount of info within the output. I desire to see solely the information I would like, so I enter the next sentence within the Immediate and select Replace question.

Present solely timestamps and latency

The question is up to date primarily based on my enter and solely the timestamp and length are returned:

fields @timestamp, @length 
| filter @sort = "REPORT" and @length > 1000
| type @length desc
| restrict 10

I run the up to date question and get a outcome that’s simpler for me to learn.

Now, I need to know if there are any errors within the log. I enter this sentence within the Immediate and generate a brand new question:

Depend the variety of ERROR messages

As requested, the generated question is counting the messages that comprise the ERROR string:

fields @message
| filter @message like /ERROR/
| stats depend()

I run the question and discover out that there are extra errors than I anticipated. I would like extra info.

I take advantage of this immediate to replace the question and get a greater distribution of the errors:

Present the errors per hour

The up to date question makes use of the bin() perform to group the end in one hour intervals.

fields @timestamp, @message
| filter @message like /ERROR/
| stats depend by bin(1h)

Let’s see a extra superior question about reminiscence utilization. I choose the log teams of some Lambda features and sort:

Present invocations with essentially the most over-provisioned reminiscence grouped by log stream

Earlier than producing the question, I select the gear icon to toggle the choices to incorporate my immediate and an evidence as remark. Right here’s the outcome (I cut up the reason over a number of traces for readability):

# Present invocations with essentially the most over-provisioned reminiscence grouped by log stream

fields @logStream, @memorySize/1000/1000 as memoryMB, @maxMemoryUsed/1000/1000 as maxMemoryUsedMB, (@memorySize/1000/1000 - @maxMemoryUsed/1000/1000) as overProvisionedMB 
| stats max(overProvisionedMB) as maxOverProvisionedMB by @logStream 
| type maxOverProvisionedMB desc

# This question finds the quantity of over-provisioned reminiscence for every log stream by
# calculating the distinction between the provisioned and most reminiscence used.
# It then teams the outcomes by log stream and calculates the utmost
# over-provisioned reminiscence for every log stream. Lastly, it kinds the outcomes
# in descending order by the utmost over-provisioned reminiscence to indicate
# the log streams with essentially the most over-provisioned reminiscence.

Now, I’ve the knowledge I would like to grasp these errors. On the opposite aspect, I even have EC2 workloads. How are these situations working? Let’s take a look at some metrics.

Generate CloudWatch Metrics Insights queries with pure language
Within the CloudWatch console, I choose All metrics within the Metrics part. Then, within the Question tab, I take advantage of the Editor. Should you desire, the Question generator is on the market additionally within the Builder.

I select Question generator like earlier than. Then, I enter what I would like utilizing plain English:

Which 10 EC2 situations have the very best CPU utilization?

I select Generate new question and get a outcome utilizing the Metrics Insights syntax.

SELECT AVG("CPUUtilization")
FROM SCHEMA("AWS/EC2", InstanceId)
GROUP BY InstanceId
ORDER BY AVG() DESC
LIMIT 10

To see the graph, I select Run.

Properly, it seems to be like my EC2 situations will not be doing a lot. This outcome exhibits how these situations are utilizing the CPU, however what about storage? I enter this within the immediate and select Replace question:

How about essentially the most EBS writes?

The up to date question replaces the common CPU utilization with the sum of bytes written to all EBS volumes hooked up to the occasion. It retains the restrict to solely present the highest 10 outcomes.

SELECT SUM("EBSWriteBytes")
FROM SCHEMA("AWS/EC2", InstanceId)
GROUP BY InstanceId
ORDER BY SUM() DESC
LIMIT 10

I run the question and, by wanting on the outcome, I’ve a greater understanding of how storage is being utilized by my EC2 situations.

Strive coming into some requests and run the generated queries over your logs and metrics to see how this works together with your knowledge.

Issues to know
Amazon CloudWatch pure language question era for logs and metrics is on the market in preview within the US East (N. Virginia) and US West (Oregon) AWS Areas.

There is no such thing as a extra price for utilizing pure language question era in the course of the preview. You solely pay for the price of working the queries in accordance with CloudWatch pricing.

Generated queries are produced by generative AI and depending on elements together with the information chosen and out there in your account. For these causes, your outcomes could fluctuate.

When producing a question, you may embrace your authentic request and an evidence of the question as feedback. To take action, select the gear icon within the backside proper nook of the question edit window and toggle these choices.

This new functionality will help you generate and replace queries for logs and metrics, saving you effort and time. This method permits engineering groups to scale their operations with out worrying about particular knowledge data or question experience.

Use pure language to investigate your logs and metrics with Amazon CloudWatch.

— Danilo