CloudWatch Logs Insights Queries

logs_insights.sql

-- Get number of emails sent by each IAM User broken down in hourly segments
stats count(*) by IAMUser, bin(1h) as period
| filter EventType in ["Delivery"]
| sort IAMUser desc, period desc

--  Get statistics for each event type (i.e. Delivery, Bounce and Complaint) for each user
fields @timestamp, EventType, IAMUser
| filter EventType in ["Delivery", "Complaint", "Bounce"]
| stats count() as email_count by IAMUser, EventType
| sort IAMUser asc, EventType asc

-- Fetch information about what addresses IAM Users are sending emails FROM, and how many.
fields IAMUser, FromAddress
| stats count() as email_count by IAMUser, FromAddress
| sort email_count DESC
| dedup IAMUser, FromAddress