‫Okay, so now let's talk about another concepts
‫of CloudWatch Logs which is the Metric Filter.
‫So CloudWatch Logs can use filter expressions,
‫for example, to search for a specific IP inside of a log,
‫or we can use a Metric Filter,
‫to do something a bit more advance,
‫such as counting the number of occurrences
‫of the word "ERROR" in your logs.
‫And so these metric filters, we can define,
‫can be used to trigger alarms.
‫So, this is the whole point of metric filters,
‫they're a bit more advanced,
‫they will look for specific occurrences
‫or counts stuff in your logs,
‫and if you reach a certain threshold,
‫then they'll trigger an alarm
‫and you can react to this.
‫So, these filters, once you create them,
‫they do not retroactively filter data.
‫The filters only publish the metric data for events
‫that happen after the filter was created.
‫So let's have a look,
‫we have the CloudWatch Logs Agents on EC2 Instance
‫streaming into CloudWatch Logs,
‫then the CloudWatch Logs will create a Metric Filter,
‫and the Metric Filter can be defined, for example,
‫to look at the number of errors in your logs.
‫Then, if we reach a threshold, we have a CloudWatch alarm
‫that gets triggered and the CloudWatch alarms,
‫for example, can send your data into a SNS topic,
‫from which we can do a lot of animations.
‫So let's go in the hands-on, to see how this works.
‫So, I'm in my CloudWatch logs and I want to take
‫the nginx access logs,
‫and I want to create a metric filter on these log streams.
‫So what I'm going to be looking for is to see
‫if somehow there's error code 400.
‫So I will type 400, as in here,
‫and we can see there's a lot of HTTP/1.1" 400 error codes,
‫so I want to create a metric filter on those and be alerted.
‫This is just a dummy use case.
‫So, I'm going to create a metric filter,
‫I can create from here, or I can go back,
‫and also go to metric filters in here and create one.
‫So, I'm going to create a metric filter,
‫and then you've to enter a pattern.
‫Now, patterns can be quite complicated,
‫there's a whole documentation on the Filter and Syntax
‫for the pattern,
‫but right now, I'm just going to look for 400
‫and make it extremely simple.
‫And then we can send custom log data to test,
‫or we can just get stuff directly from my logs,
‫and then test the pattern,
‫and the result is that,
‫it found 14 matches out of 50 events in the sample logs.
‫So that means that, my pattern,
‫very, very simple, is working fine.
‫Then, I will scroll down and click on next,
‫and then I have to give a name to this metric filter,
‫so, I will say, MetricFilter400Code, okay.
‫Then we need to give a metric namespace,
‫so I'll call it MetricFilters,
‫and then a metric name, MyDemoFilter,
‫and then the metric value,
‫so whenever a match occurs, so we can say, for example,
‫published value number one, okay.
‫And then, the default value, if no value is published,
‫is going to be zero.
‫I click on next, and I create this metric filter.
‫So now, this Metric Filter has been created.
‫And so, if I go into my metrics, in here,
‫I'm able to see, so currently, nothing has been published,
‫because as I said, the metric filter is not retroactive.
‫So we need to make this Metric Filter work,
‫and for this, very simply,
‫I'm gonna go into MyFirstBeanstalk-environment,
‫and then I'm going to do an environment action,
‫and I went to restart the app servers,
‫and this should trigger a lot more logs
‫to be written out into CloudWatch logs.
‫So when I wait, is just go back in here,
‫and I wait about five minutes for my environment
‫to be rebuilt, and hopefully,
‫the metric filter will start showing up
‫in CloudWatch metrics.
‫So my environment has now been restarted,
‫and I'm going to go and open it up as well,
‫and I'm going to do /test,
‫just to trigger something, and we're good to go.
‫Okay, so now let's go back into CloudWatch,
‫and I'm going to refresh this,
‫and hopefully, very, very soon,
‫we should start seeing some metrics.
‫Okay, so I have now refreshed my CloudWatch metrics page,
‫and thankfully, what we start seeing,
‫is a Custom Namespace, called metric filters,
‫that was the one we created,
‫and then we create this metric,
‫and this is MyDemoFilter.
‫Now, it's not very interesting as a metric,
‫because the value is zero right now,
‫so that means we haven't detected any 400 events,
‫but what I wanna show you is that,
‫it didn't backfill the data for previous events,
‫so metric filters only added data as soon as I created.
‫So, it's not very interesting in this graph,
‫but that's okay.
‫Another thing we can do with this metric filter
‫is to click on it, and then create an alarm,
‫and so by creating CloudWatch alarm,
‫we can do some automation,
‫so I'm just going to create a dummy CloudWatch alarm.
‫So, I will use MyDemoFilter, currently, there's nothing,
‫but I can say, okay, if as a static thresholds,
‫you are greater than, I would say 50,
‫then something is really, really wrong
‫with my web application,
‫and therefore, I'm going to click on next,
‫and we could say, okay, the alarm should be In alarm,
‫and I'm going to send my alarm to an existing SMS topic,
‫maybe this one, maybe another one,
‫and then, I can say next,
‫and say, DemoMetricFilterAlarm,
‫and that's it.
‫So, now we've created a CloudWatch alarm
‫on top of our MetricFilter coming from CloudWatch logs,
‫so you can see, there's a lot of different
‫CloudWatch services coming together, in this example,
‫and create the alarm.
‫And now, I have the basis for my notifications.
‫Obviously, this won't happen right now,
‫I won't get any notification,
‫but you get the general idea,
‫and this is how you would go ahead
‫and create your own Metric filters.
‫And so, if I refreshed this now, this page,
‫what I should be seeing is on the bottom,
‫that's yes, this metric filter is linked to an alarm
‫called DemoMetricFilterAlarm.
‫So, this is great.
‫I hope you liked it,
‫and I will see you in the next lecture.