メトリクスフィルターの例

このセクションでは、Route 53 Global Resolver DNS クエリログのメトリクスフィルターパターンの例と Amazon CloudWatch Logs Insights クエリについて説明します。

Global Resolver によるブロックされたクエリ

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "BlockedQueriesByGlobalResolverId",
 "filterPattern": "{ $.disposition = \"Blocked\" }",
 "metricTransformations": [
   {
     "metricName": "BlockedQueriesByGlobalResolverId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "GlobalResolverId": "$.enrichments[0].value" }
   }
 ]
}

アクセスソースで許可されるクエリ

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "AllowedQueriesByAccessSourceCidr",
 "filterPattern": "{ $.disposition = \"Allowed\" }",
 "metricTransformations": [
   {
     "metricName": "AllowedQueriesByAccessSourceCidr",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessSourceCidr": "$.enrichments[0].data.access_source_cidr" }
   }
 ]
}

アクセストークンによるアラートクエリ

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "AlertQueriesByAccessTokenId",
 "filterPattern": "{ $.disposition = \"Alert\" }",
 "metricTransformations": [
   {
     "metricName": "AlertQueriesByAccessTokenId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessTokenId": "$.enrichments[0].data.token_id" }
   }
 ]
}

DNS ビュー別のクエリの合計数

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "TotalQueriesByDNSViewId",
 "filterPattern": "{ $.query_time = * }",
 "metricTransformations": [
   {
     "metricName": "TotalQueriesByDNSViewId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "DNSViewId": "$.enrichments[0].data.dns_view_id" }
   }
 ]
}

グローバルリゾルバーによる SERVFAIL

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "ServfailQueriesByGlobalResolverId",
 "filterPattern": "{ $.rcode = \"SERVFAIL\" }",
 "metricTransformations": [
   {
     "metricName": "ServfailQueriesByGlobalResolverId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "GlobalResolverId": "$.enrichments[0].value" }
   }
 ]
}

アクセスソースによって拒否

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "RefusedQueriesByAccessSourceCidr",
 "filterPattern": "{ $.rcode = \"REFUSED\" }",
 "metricTransformations": [
   {
     "metricName": "RefusedQueriesByAccessSourceCidr",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessSourceCidr": "$.enrichments[0].data.access_source_cidr" }
   }
 ]
}

アクセストークン別の NXDOMAIN

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "NxdomainQueriesByAccessTokenId",
 "filterPattern": "{ $.rcode = \"NXDOMAIN\" }",
 "metricTransformations": [
   {
     "metricName": "NxdomainQueriesByAccessTokenId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "AccessTokenId": "$.enrichments[0].data.token_id" }
   }
 ]
}

DNS ビュー別の NOERROR

{
 "logGroupName": "/aws/vendedlogs/route53globalresolver/global-resolver/GLOBAL_RESOLVER_LOGS/gr-<resolverId>",
 "filterName": "NoerrorQueriesByDNSViewId",
 "filterPattern": "{ $.rcode = \"NOERROR\" }",
 "metricTransformations": [
   {
     "metricName": "NoerrorQueriesByDNSViewId",
     "metricNamespace": "Route53GlobalResolver",
     "metricValue": "1",
     "dimensions": { "DNSViewId": "$.enrichments[0].data.dns_view_id" }
   }
 ]
}

P90 応答時間の Amazon CloudWatch Logs Insights クエリ

グローバルリゾルバー別の P90 応答時間

fields @timestamp,
      enrichments.0.value as GlobalResolverId,
      (response_time - query_time) as ResponseTime
| filter ispresent(response_time) and ispresent(query_time)
| stats pct(ResponseTime, 90) as P90ResponseTime by GlobalResolverId

アクセストークンによるトークンの有効期限が切れるまでの日数

fields @timestamp,
      enrichments.0.data.token_id as AccessTokenId,
      enrichments.0.data.token_ttl_days as DaysUntilExpiry
| filter ispresent(enrichments.0.data.token_ttl_days)
| stats latest(DaysUntilExpiry) by AccessTokenId