Exemples de filtres métriques

Cette section contient des exemples de modèles de filtres de métriques et de requêtes Amazon CloudWatch Logs Insights pour les journaux de requêtes DNS Route 53 Global Resolver.

Requêtes bloquées par Global Resolver

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "BlockedQueriesByGlobalResolverId",
 "filterPattern": "{ $.disposition = \"Blocked\" }",
 "metricTransformations": [
   {
     "metricName": "BlockedQueriesByGlobalResolverId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "GlobalResolverId": "$.enrichments[0].value" }
   }
 ]
}

Requêtes autorisées par source d'accès

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "AllowedQueriesByAccessSourceCidr",
 "filterPattern": "{ $.disposition = \"Allowed\" }",
 "metricTransformations": [
   {
     "metricName": "AllowedQueriesByAccessSourceCidr",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessSourceCidr": "$.enrichments[0].data.access_source_cidr" }
   }
 ]
}

Requêtes d'alerte par jeton d'accès

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "AlertQueriesByAccessTokenId",
 "filterPattern": "{ $.disposition = \"Alert\" }",
 "metricTransformations": [
   {
     "metricName": "AlertQueriesByAccessTokenId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessTokenId": "$.enrichments[0].data.token_id" }
   }
 ]
}

Nombre total de requêtes par vue DNS

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "TotalQueriesByDNSViewId",
 "filterPattern": "{ $.query_time = * }",
 "metricTransformations": [
   {
     "metricName": "TotalQueriesByDNSViewId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "DNSViewId": "$.enrichments[0].data.dns_view_id" }
   }
 ]
}

SERVFAIL par Global Resolver

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "ServfailQueriesByGlobalResolverId",
 "filterPattern": "{ $.rcode = \"SERVFAIL\" }",
 "metricTransformations": [
   {
     "metricName": "ServfailQueriesByGlobalResolverId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "GlobalResolverId": "$.enrichments[0].value" }
   }
 ]
}

REFUSÉ par Access Source

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "RefusedQueriesByAccessSourceCidr",
 "filterPattern": "{ $.rcode = \"REFUSED\" }",
 "metricTransformations": [
   {
     "metricName": "RefusedQueriesByAccessSourceCidr",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessSourceCidr": "$.enrichments[0].data.access_source_cidr" }
   }
 ]
}

NXDOMAIN par jeton d'accès

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "NxdomainQueriesByAccessTokenId",
 "filterPattern": "{ $.rcode = \"NXDOMAIN\" }",
 "metricTransformations": [
   {
     "metricName": "NxdomainQueriesByAccessTokenId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessTokenId": "$.enrichments[0].data.token_id" }
   }
 ]
}

NOERROR par DNS View

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "NoerrorQueriesByDNSViewId",
 "filterPattern": "{ $.rcode = \"NOERROR\" }",
 "metricTransformations": [
   {
     "metricName": "NoerrorQueriesByDNSViewId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "DNSViewId": "$.enrichments[0].data.dns_view_id" }
   }
 ]
}

Requêtes Amazon CloudWatch Logs Insights pour un temps de réponse P90

Temps de réponse du P90 par Global Resolver

fields @timestamp,
      enrichments.0.value as GlobalResolverId,
      (response_time - query_time) as ResponseTime
| filter ispresent(response_time) and ispresent(query_time)
| stats pct(ResponseTime, 90) as P90ResponseTime by GlobalResolverId

Jours avant l'expiration du jeton par Access Token

fields @timestamp,
      enrichments.0.data.token_id as AccessTokenId,
      enrichments.0.data.token_ttl_days as DaysUntilExpiry
| filter ispresent(enrichments.0.data.token_ttl_days)
| stats latest(DaysUntilExpiry) by AccessTokenId