Amazon CloudWatch
User Guide

CloudWatch Search Expression Examples

The following examples illustrate more search expression uses and syntax. Let's start with a search for CPUUtilization across all instances in the Region and then look at variations.

This example displays one line for each instance in the Region, showing the CPUUtilization metric from the AWS/EC2 namespace.

SEARCH(' {AWS/EC2,InstanceId} MetricName="CPUUtilization" ', 'Average', 300)

Changing InstanceId to InstanceType changes the graph to show one line for each instance type used in the Region. Data from all instances of each type is aggregated into one line for that instance type.

SEARCH(' {AWS/EC2,InstanceType} MetricName="CPUUtilization" ', 'Average', 300)

Removing the dimension name but keeping the namespace in the schema, as in the following example, results in a single line showing the aggregation of CPUUtilization metrics for all instances in the Region.

SEARCH(' {AWS/EC2} MetricName="CPUUtilization" ', 'Average', 300)

The following example aggregates the CPUUtilization by instance type and displays one line for each instance type that includes the string micro.

SEARCH(' {AWS/EC2,InstanceType} InstanceType=micro MetricName="CPUUtilization" ', 'Average', 300)

This example narrows the previous example, changing the InstanceType to an exact search for t2.micro instances.

SEARCH(' {AWS/EC2,InstanceType} InstanceType="t2.micro" MetricName="CPUUtilization" ', 'Average', 300)

The following search removes the {metric schema} part of the query, so the CPUUtilization metric from all namespaces appears in the graph. This can return quite a few results because the graph includes multiple lines for the CPUUtilization metric from each AWS service, aggregated along different dimensions.

SEARCH(' MetricName="CPUUtilization" ', 'Average', 300)

To narrow these results a bit, you can specify two specific metric namespaces.

SEARCH(' MetricName="CPUUtilization" AND ("AWS/ECS" OR "AWS/ES") ', 'Average', 300)

The preceding example is the only way to do a search of specific multiple namespaces with one search query, as you can specify only one metric schema in each query. However, to add more structure, you could use two queries in the graph, as in the following example. This example also adds more structure by specifying a dimension to use to aggregate the data for Amazon ECS.

SEARCH(' {AWS/ECS, ClusterName}, MetricName="CPUUtilization" ', 'Average', 300) SEARCH(' {AWS/EBS}, MetricName="CPUUtilization" ', 'Average', 300)

The following example returns the Elastic Load Balancing metric named ConsumedLCUs as well as all Elastic Load Balancing metrics or dimensions that contain the token flow.

SEARCH(' {AWS/NetworkELB, LoadBalancer}, "ConsumedLCUs" OR flow ', 'Maximum', 120)

The following example uses nested grouping. It returns Lambda metrics for Errors from all functions and Invocations of functions with names that include the strings ProjectA or ProjectB.

SEARCH(' {AWS/Lambda,FunctionName} MetricName="Errors" OR (MetricName="Invocations" AND (ProjectA OR ProjectB)) ', 'Average', 600)

The following example displays all of your custom metrics, excluding metrics generated by AWS services.

SEARCH(' NOT Namespace=AWS ', 'Average', 120)

The following example displays metrics with metric names, namespaces, dimension names, and dimension values that contain the string Errors as part of their name.

SEARCH(' Errors ', 'Average', 300)

The following example narrows that search to exact matches. For example, this search finds the metric name Errors but not metrics named ConnectionErrors or errors.

SEARCH(' "Errors" ', 'Average', 300)

The following example shows how to specify names that contain spaces or special characters in the metric schema part of the search term.

SEARCH(' {"Custom-Namespace", "Dimension Name With Spaces"}, ErrorCount ', 'Maximum', 120)