Cloud Watch Queries

cloud_watch.md

README

This README would normally document whatever steps are necessary to get your application up and running.

What is this repository for?

• Quick summary
• Version
• Learn Markdown

Query Notification Command Inbound SQS message

fields  messageBody.orgConfiguration.orgId as orgId, 
ltrim(rtrim(rtrim(messageBody.orgConfiguration.baseUrl, "agyletime.io"), "agyletime.net"), "https://") as subdomain, 
messageBody.subscription.userId as userId, 
messageBody.subscription.createdBy.identifier as identifier, 
messageBody.subscription.notificationTypeId as notificationType, 
messageBody.subscription.configuration.type as configType, 
@timestamp, @logStream
| filter @message like /(?i)(Start processing inbound sqs message)/
| sort @timestamp desc
| limit 200

Query /user/me API CALL

filter @message like /\/api\/organisation\/user/
| stats count(*) as APICOUNT by bin(1h)
| sort APICOUNT desc
| limit 20

Query Get published shifts by user

ffields @timestamp, @message
| filter @message like /(?i)(\/api\/schedule\/2.0.0\/shifts\/published\/users\/)/
| parse '"organisationId":*,' as organisationId
| stats count(*) as APICOUNT by bin(1m), organisationId
| sort APICOUNT desc


fields @timestamp, @message
| filter @message like /(?i)(\/api\/schedule\/2.0.0\/shifts\/published\/users\/)/
| parse '"organisationId":*,' as organisationId
| parse '"path":"*users' as path
| stats count(*) as APICOUNT by bin(1m), organisationId,path
| sort APICOUNT desc
| limit 10

## Across Multiple APIs
fields @timestamp, @message
| filter @message like /(?i)(\/api\/)/
| filter @message like /(?i)(Request end)/
| filter @message not like /(?i)(health|payCategory|definitions)/
| parse '"organisationId":*,' as organisationId
| parse '"path":"*"' as path
| stats count(*) as APICOUNT by bin(1h), organisationId,path
| sort APICOUNT desc

Query Forecast

# Trigger JOB - Send SQS Msg to create forecast 
fields @timestamp, @message
| filter @message like /Sending SQS Msg - Daily Forecast Request/
| sort @timestamp desc
| limit 200


# Receive Message from SQS /pyforecast
fields @timestamp, @message
| filter @message like /Receive SQS Message - Daily Forecast Request/
| sort @timestamp desc
| limit 200

# Send Message to Kinesis after processing SQS Message /pyforecast
fields @timestamp, @message
| filter @message like /Send Kinesis Event  - Publish Daily Forecast/
| sort @timestamp desc
| limit 200


# Kinesis Event Process by `/aws/lambda/forecast-intraday`
fields @timestamp, @message
| filter @message like /Processing Published Daily Forecast Event/
| sort @timestamp desc
| limit 200


# COMBO
fields @timestamp, @message
| filter @message like /(Sending SQS Msg - Daily Forecast Request)|(INFO:at:Receive SQS Message- Daily Forecast Request)|(Send Kinesis Event - Publish Daily Forecast)|(Processing Published Daily Forecast Event)/
| sort @timestamp desc
| limit 400

Agent status post

fields @timestamp, @message
| filter @message like /(?i)(POST api\/workactivity\/agents\/perill)/
| sort @timestamp desc
| limit 40

Parse Response Time

fields @timestamp, @message
| filter @message like /(?i)(\/metric)/
| parse 'Request end in * ms' as respTime
| sort respTime desc

Parse Leave

fields @timestamp, @message
| filter @message like /(?i)("\/api\/schedule\/leave")/
| parse 'Request end in * ms' as respTime
| sort respTime desc

Get Calendar

fields @timestamp, @message
| filter @message like /(?i)("\/api\/schedule\/calendar\/availabilities")/
| filter @message like /GET/
| parse 'Request end in * ms' as respTime
| sort respTime desc

Query Forecast API Gateway

Get Forecast Requirements

fields @timestamp, @message
| filter @message like 'GET fetchRequirementById'
| stats count(*) as APICOUNT by bin(1h)
| sort APICOUNT desc
| sort @timestamp desc

New aggregation

workactivity-commands-alpha-queryWorkstreamDataAthena
workactivity-metrics-commands-alpha-handleWsQueriesS3Event
workactivity-metrics-commands-alpha-replayAWSDFromS3