Contoh filter metrik

Bagian ini berisi contoh pola filter metrik dan kueri Amazon CloudWatch Logs Insights untuk log kueri DNS Route 53 Global Resolver.

Kueri yang diblokir oleh Global Resolver

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "BlockedQueriesByGlobalResolverId",
 "filterPattern": "{ $.disposition = \"Blocked\" }",
 "metricTransformations": [
   {
     "metricName": "BlockedQueriesByGlobalResolverId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "GlobalResolverId": "$.enrichments[0].value" }
   }
 ]
}

Kueri yang diizinkan oleh Sumber Akses

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "AllowedQueriesByAccessSourceCidr",
 "filterPattern": "{ $.disposition = \"Allowed\" }",
 "metricTransformations": [
   {
     "metricName": "AllowedQueriesByAccessSourceCidr",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessSourceCidr": "$.enrichments[0].data.access_source_cidr" }
   }
 ]
}

Kueri peringatan dengan Token Akses

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "AlertQueriesByAccessTokenId",
 "filterPattern": "{ $.disposition = \"Alert\" }",
 "metricTransformations": [
   {
     "metricName": "AlertQueriesByAccessTokenId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessTokenId": "$.enrichments[0].data.token_id" }
   }
 ]
}

Total kueri berdasarkan Tampilan DNS

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "TotalQueriesByDNSViewId",
 "filterPattern": "{ $.query_time = * }",
 "metricTransformations": [
   {
     "metricName": "TotalQueriesByDNSViewId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "DNSViewId": "$.enrichments[0].data.dns_view_id" }
   }
 ]
}

SERVFAIL oleh Global Resolver

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "ServfailQueriesByGlobalResolverId",
 "filterPattern": "{ $.rcode = \"SERVFAIL\" }",
 "metricTransformations": [
   {
     "metricName": "ServfailQueriesByGlobalResolverId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "GlobalResolverId": "$.enrichments[0].value" }
   }
 ]
}

Ditolak oleh Sumber Akses

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "RefusedQueriesByAccessSourceCidr",
 "filterPattern": "{ $.rcode = \"REFUSED\" }",
 "metricTransformations": [
   {
     "metricName": "RefusedQueriesByAccessSourceCidr",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessSourceCidr": "$.enrichments[0].data.access_source_cidr" }
   }
 ]
}

NXDOMAIN oleh Token Akses

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "NxdomainQueriesByAccessTokenId",
 "filterPattern": "{ $.rcode = \"NXDOMAIN\" }",
 "metricTransformations": [
   {
     "metricName": "NxdomainQueriesByAccessTokenId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessTokenId": "$.enrichments[0].data.token_id" }
   }
 ]
}

NOERROR oleh Tampilan DNS

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "NoerrorQueriesByDNSViewId",
 "filterPattern": "{ $.rcode = \"NOERROR\" }",
 "metricTransformations": [
   {
     "metricName": "NoerrorQueriesByDNSViewId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "DNSViewId": "$.enrichments[0].data.dns_view_id" }
   }
 ]
}

Kueri Amazon CloudWatch Logs Insights untuk waktu respons P90

Waktu Respons P90 oleh Global Resolver

fields @timestamp,
      enrichments.0.value as GlobalResolverId,
      (response_time - query_time) as ResponseTime
| filter ispresent(response_time) and ispresent(query_time)
| stats pct(ResponseTime, 90) as P90ResponseTime by GlobalResolverId

Hari hingga token kedaluwarsa oleh Token Akses

fields @timestamp,
      enrichments.0.data.token_id as AccessTokenId,
      enrichments.0.data.token_ttl_days as DaysUntilExpiry
| filter ispresent(enrichments.0.data.token_ttl_days)
| stats latest(DaysUntilExpiry) by AccessTokenId