Setting alarms on metrics created with the embedded metric format

In general, creating alarms on metrics generated by the embedded metric format follows the same pattern as creating alarms on any other metrics. For more information, see Using Amazon CloudWatch alarms. Embedded metric format metric generation depends on your log publishing flow because CloudWatch Logs needs to process logs so they can be transformed into metrics. It’s important to publish logs in a timely manner, so that metric datapoints are created within the period of time that alarms are evaluated.

If you plan on using the embedded metric format to send high-resolution metrics and create alarms on these metrics, we recommended that you flush logs to CloudWatch Logs at an interval of 5 seconds or less to avoid introducing an additional delay, which can cause alarming on partial or missing data. If you are using the CloudWatch agent, you can adjust the flush interval by setting the force_flush_interval parameter in the CloudWatch agent configuration file. This value defaults to 5 seconds. If you are using Lambda on other platforms where you can’t control the log flush interval, consider using “M out of N” alarms to control the number of datapoints used to alarm. For more information, see Evaluating an alarm.