CloudWatch search expression examples
The following examples illustrate more search expression uses and syntax. Let's start
with a search for CPUUtilization across all instances in the Region and then
look at variations.
This example displays one line for each instance in the Region, showing the CPUUtilization metric from the AWS/EC2
namespace.
SEARCH(' {AWS/EC2,InstanceId} MetricName="CPUUtilization" ', 'Average')
Changing InstanceId to InstanceType changes the graph to show one line for each instance type used in
the Region. Data from all instances of each type is aggregated into one line for that instance type.
SEARCH(' {AWS/EC2,InstanceType} MetricName="CPUUtilization" ', 'Average')
The following example aggregates the CPUUtilization by instance type and
displays one line for each instance type that includes the string micro.
SEARCH('{AWS/EC2,InstanceType} InstanceType=micro MetricName="CPUUtilization" ', 'Average')
This example narrows the previous example, changing the InstanceType to an exact search for
t2.micro instances.
SEARCH('{AWS/EC2,InstanceType} InstanceType="t2.micro" MetricName="CPUUtilization" ', 'Average')
The following search removes the {metric schema} part of the query, so the
CPUUtilization metric from all namespaces appears in the graph. This can
return quite a few results because the graph includes multiple lines for the
CPUUtilization metric from each AWS service, aggregated along different
dimensions.
SEARCH('MetricName="CPUUtilization" ', 'Average')
To narrow these results a bit, you can specify two specific metric namespaces.
SEARCH('MetricName="CPUUtilization" AND ("AWS/ECS" OR "AWS/ES") ', 'Average')
The preceding example is the only way to do a search of specific multiple namespaces with one search query, as you can specify only one metric schema in each query. However, to add more structure, you could use two queries in the graph, as in the following example. This example also adds more structure by specifying a dimension to use to aggregate the data for Amazon ECS.
SEARCH('{AWS/ECS ClusterName}, MetricName="CPUUtilization" ', 'Average') SEARCH(' {AWS/EBS} MetricName="CPUUtilization" ', 'Average')
The following example returns the Elastic Load Balancing metric named ConsumedLCUs as well as all Elastic Load Balancing metrics or dimensions that contain the token flow.
SEARCH('{AWS/NetworkELB, LoadBalancer} "ConsumedLCUs" OR flow ', 'Maximum')
The following example uses nested grouping. It returns Lambda metrics for
Errors from all functions and Invocations of functions with
names that include the strings ProjectA or ProjectB.
SEARCH('{AWS/Lambda,FunctionName} MetricName="Errors" OR (MetricName="Invocations" AND (ProjectA OR ProjectB)) ', 'Average')
The following example displays all of your custom metrics, excluding metrics generated by AWS services.
SEARCH('NOT Namespace=AWS ', 'Average')
The following example displays metrics with metric names, namespaces,
dimension names, and dimension values that contain the string Errors
as part of their name.
SEARCH('Errors', 'Average')
The following example narrows that search to exact matches. For example, this search
finds the metric name Errors but not metrics named
ConnectionErrors or errors.
SEARCH(' "Errors" ', 'Average')
The following example shows how to specify names that contain spaces or special characters in the metric schema part of the search term.
SEARCH('{"Custom-Namespace", "Dimension Name With Spaces"}, ErrorCount ', 'Maximum')
CloudWatch cross-account observability search expression examples
CloudWatch cross-account observability examples
If you are signed in to an account that is set up as a monitoring account in CloudWatch cross-account observability, you can use the SEARCH function to return metrics from specified source accounts. For more information, see CloudWatch cross-account observability.
The following example retrieves all Lambda metrics from the account with the account ID 111122223333.
SEARCH(' AWS/Lambda :aws.AccountId = 111122223333 ', 'Average')
The following example retrieves all AWS/EC2 metrics from two accounts: 111122223333 and 777788889999.
SEARCH(' AWS/EC2 :aws.AccountId = (111122223333 OR 777788889999) ', 'Average')
The following example retrieves all AWS/EC2 metrics from the source account 111122223333 and from the monitoring
account itself.
SEARCH(' AWS/EC2 :aws.AccountId = (111122223333 OR 'LOCAL') ', 'Average')
The following example retrieves the SUM of the MetaDataToken metric
from the account 444455556666 with the InstanceId dimension.
SEARCH('{AWS/EC2,InstanceId} :aws.AccountId=444455556666 MetricName=\"MetadataNoToken\"','Sum')
