Part of the DJames Network / DJames617
Explore the Network
DJames617Personal, professional, creative, and educational hub NerdDualCyber operations, intelligence, resources, and public tools HDJamesAuthenticated application lab and proving ground
DJames617 The DoWell Nerd

Hands-On Mini Lab

CloudWatch Log Metric Filter Lab

Small log ingestion, metric, and alarm costs can apply. Delete all resources at the end.

Goal

Reinforce Logs versus metrics, Metric filters, Alarms, Operational evidence through a small, inspectable activity.

Concepts Reinforced

  • Logs versus metrics
  • Metric filters
  • Alarms
  • Operational evidence

Prerequisites

  • AWS CLI configured
  • Permission to create CloudWatch Logs resources and alarms

Estimated Cost

Exact Steps

  1. Create a temporary log group.
  2. Put a metric filter that counts lines containing ERROR.
  3. Create an alarm on the custom metric.
  4. Write a sample log event that contains ERROR.
  5. Observe metric/alarm behavior after CloudWatch processes the event.
Runnable example with a current Unix timestamp in milliseconds
aws logs create-log-group --log-group-name /djames/study/cloudwatch
aws logs put-metric-filter --log-group-name /djames/study/cloudwatch --filter-name ErrorCount --filter-pattern "ERROR" --metric-transformations metricName=StudyErrorCount,metricNamespace=DJamesStudy,metricValue=1
aws cloudwatch put-metric-alarm --alarm-name DJamesStudyErrorAlarm --namespace DJamesStudy --metric-name StudyErrorCount --statistic Sum --period 60 --evaluation-periods 1 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold

Verification

  • The metric filter exists.
  • The custom metric appears in CloudWatch.
  • The alarm can be described by name.

Cleanup Steps

  • Delete the alarm.
  • Delete the metric filter.
  • Delete the log group.

Sources and Review Metadata

This independent training application is not affiliated with or endorsed by Amazon Web Services. AWS, Amazon Web Services, and AWS certification names are trademarks of Amazon.com, Inc. or its affiliates.