-: Okay, So I am in CloudWatch logs
and we can see all the log groups we have right now.
So as you can see,
we have eight of them and they were created
by some services.
For example, this one was created by Lambda.
This one was created by datasync.
This one was created by glue
and this one was created by us
when we did do an SSM runCommand
and we wanted the output to be populated in this log group.
So, if we take a look at this example, for example,
we have six log streams
and so each of them represents a different instance
that we did run a specific run command on.
So, this is the same runcommond ID across the six.
Here, we have a different instance ID for each of the six,
so two and two and then we have,
stdout and stderr.
So if you look at stdout,
we can look at all the logs that was generated
by this command
and we can have a look at all the log lines and so on.
So this is quite (indistinct).
And the idea is that,
from the log for example,
you can look through the keyword http
and it would show you all the log lines
that contain the word htp.
If you just look for the word installing, for example,
it will show you just maybe two or three log lines
that contain the word installing.
So that's certainly (indistinct).
And so we have, for stdout, stderr,
so we can see really the idea behind different log streams.
Now, we can create metric filters in here,
and these metric filters
is a way for us to find a filter pattern.
For example, installing.
Okay,
And then we need to select for example,
a custom data, for example, this log stream
and then we test a pattern and it's going to give us
three matches out of five in the simple logs.
Now, if you went ahead with entering this filter name,
as we can see,
it could call it DemoFilter
and DemometricFilter.
And this is a new namespace, okay.
And here is DemoMetric.
So this is DemoMetric filter namespace,
and this is a DemometricFilter.
And then, the metric value, okay.
When there is a filter pattern or matching occur
and so, you can say one for example,
to add one and to count how many times
this installing lines have been filmed.
And the default value and the unit if you want it to,
then click on next, create
and this will give you a new metrics
so, if you went into CloudWatch metric right here
and we're going to clear this graph
and we're going to find a new metrics.
So let's refresh this page.
Maybe this is going to help us.
Okay, so if we go to all new spaces,
as soon as this metric filter would appear,
it would appear right here and we could visualize it.
But currently, because we don't send any log output,
then we don't see it.
But the idea is that,
we could create an alarm on top of this metric filter
So we can click on create alarm.
and this would allow us to create
an alarm in case,
for example, a metric went over a specific value
and again, this metric is calculated based on the filter
from the log streams.
We could also create subscription filters.
So as you can see here,
we can create a filter for different outcomes.
So Elasticsearch, Kinesis, datastreams,
Kinesis Firehose or a Lambda subscription filter
if you want to send data into custom lambda functions.
And, we can create up to two subscription filters
per log group according to this, okay.
Now, we can also edit the retention settings.
So, we can see that the logs can never expire
all the way up to 120 months.
Okay, so 10 years.
And then, we can also export the data into Amazon S3.
So you can click on export data
You can choose a range of data to export
and then, the stream prefix,
if you wanted to just get specific log streams,
and then the S3 buckets and the bucket prefix,
and you'd be good to go.
And the finally,
in here, you can create a log group
(indistinct) demo-log-group.
Okay, you can set up the retention settings.
KMS key, if you wanted to encrypt that log group
and then click on create.
And so, the encryption setting would appear then here,
if a KMS key ID was specified.
Okay and then finally,
CloudWatch Logs Insights,
is allowing you to use a nice query language
to query some specific log groups.
So for example, we can create this one
and run the query.
And then, this is not going to give us any data
because we're looking for data from the past hour.
But if we look at data from the past 60 days
and run this query, maybe we'll find something.
So you can see, we found
18 records from this query.
And so, this gives us a nice query language
to start gaining some insights on top of our logs.
And on top of it,
you can export the results if you want it to.
And on the right hand side,
you can see that you can save your queries. Okay?
So you can query and save them here.
Or, you can look at some simple queries
and view the use cases of losing log insights for example,
view the latency statistics
for a five minute interval on Lambda,
or get the top 10 by transfers
by source and destination IP addresses for VPC flow logs.
So it gives you,
for example, if you should click on these,
some nice insights to how the query language works
for CloudWatch logs insights.
So this is CloudWatch logs.
I hope you liked it
and I will see you in the next lecture.