‫Okay, So I am in CloudWatch logs
‫and we can see all the log groups we have right now.
‫So as you can see,
‫we have eight of them and they were created
‫by some services.
‫For example, this one was created by Lambda.
‫This one was created by datasync.
‫This one was created by glue
‫and this one was created by us
‫when we did do an SSM runCommand
‫and we wanted the output to be populated in this log group.
‫So, if we take a look at this example, for example,
‫we have six log streams
‫and so each of them represents a different instance
‫that we did run a specific run command on.
‫So, this is the same runcommond ID across the six.
‫Here, we have a different instance ID for each of the six,
‫so two and two and then we have,
‫stdout and stderr.
‫So if you look at stdout,
‫we can look at all the logs that was generated
‫by this command
‫and we can have a look at all the log lines and so on.
‫So this is quite (indistinct).
‫And the idea is that,
‫from the log for example,
‫you can look through the keyword http
‫and it would show you all the log lines
‫that contain the word htp.
‫If you just look for the word installing, for example,
‫it will show you just maybe two or three log lines
‫that contain the word installing.
‫So that's certainly (indistinct).
‫And so we have, for stdout, stderr,
‫so we can see really the idea behind different log streams.
‫Now, we can create metric filters in here,
‫and these metric filters
‫is a way for us to find a filter pattern.
‫For example, installing.
‫Okay,
‫And then we need to select for example,
‫a custom data, for example, this log stream
‫and then we test a pattern and it's going to give us
‫three matches out of five in the simple logs.
‫Now, if you went ahead with entering this filter name,
‫as we can see,
‫it could call it DemoFilter
‫and DemometricFilter.
‫And this is a new namespace, okay.
‫And here is DemoMetric.
‫So this is DemoMetric filter namespace,
‫and this is a DemometricFilter.
‫And then, the metric value, okay.
‫When there is a filter pattern or matching occur
‫and so, you can say one for example,
‫to add one and to count how many times
‫this installing lines have been filmed.
‫And the default value and the unit if you want it to,
‫then click on next, create
‫and this will give you a new metrics
‫so, if you went into CloudWatch metric right here
‫and we're going to clear this graph
‫and we're going to find a new metrics.
‫So let's refresh this page.
‫Maybe this is going to help us.
‫Okay, so if we go to all new spaces,
‫as soon as this metric filter would appear,
‫it would appear right here and we could visualize it.
‫But currently, because we don't send any log output,
‫then we don't see it.
‫But the idea is that,
‫we could create an alarm on top of this metric filter
‫So we can click on create alarm.
‫and this would allow us to create
‫an alarm in case,
‫for example, a metric went over a specific value
‫and again, this metric is calculated based on the filter
‫from the log streams.
‫We could also create subscription filters.
‫So as you can see here,
‫we can create a filter for different outcomes.
‫So Elasticsearch, Kinesis, datastreams,
‫Kinesis Firehose or a Lambda subscription filter
‫if you want to send data into custom lambda functions.
‫And, we can create up to two subscription filters
‫per log group according to this, okay.
‫Now, we can also edit the retention settings.
‫So, we can see that the logs can never expire
‫all the way up to 120 months.
‫Okay, so 10 years.
‫And then, we can also export the data into Amazon S3.
‫So you can click on export data
‫You can choose a range of data to export
‫and then, the stream prefix,
‫if you wanted to just get specific log streams,
‫and then the S3 buckets and the bucket prefix,
‫and you'd be good to go.
‫And the finally,
‫in here, you can create a log group
‫(indistinct) demo-log-group.
‫Okay, you can set up the retention settings.
‫KMS key, if you wanted to encrypt that log group
‫and then click on create.
‫And so, the encryption setting would appear then here,
‫if a KMS key ID was specified.
‫Okay and then finally,
‫CloudWatch Logs Insights,
‫is allowing you to use a nice query language
‫to query some specific log groups.
‫So for example, we can create this one
‫and run the query.
‫And then, this is not going to give us any data
‫because we're looking for data from the past hour.
‫But if we look at data from the past 60 days
‫and run this query, maybe we'll find something.
‫So you can see, we found
‫18 records from this query.
‫And so, this gives us a nice query language
‫to start gaining some insights on top of our logs.
‫And on top of it,
‫you can export the results if you want it to.
‫And on the right hand side,
‫you can see that you can save your queries. Okay?
‫So you can query and save them here.
‫Or, you can look at some simple queries
‫and view the use cases of losing log insights for example,
‫view the latency statistics
‫for a five minute interval on Lambda,
‫or get the top 10 by transfers
‫by source and destination IP addresses for VPC flow logs.
‫So it gives you,
‫for example, if you should click on these,
‫some nice insights to how the query language works
‫for CloudWatch logs insights.
‫So this is CloudWatch logs.
‫I hope you liked it
‫and I will see you in the next lecture.