View a markdown version of this page

使用 CloudWatch Logs Insights 查询日志 - Amazon Simple Storage Service
开始使用流量分析错误排查访问模式延迟分析成本归属安全分析

使用 CloudWatch Logs Insights 查询日志

CloudWatch Logs Insights 可让您以交互方式搜索和分析您的服务器访问日志数据。查询会针对发送日志的日志组运行，并在几秒钟内返回结果。

注意

有关查询传输到 Amazon S3 通用存储桶的日志，请参阅使用 Amazon Athena 查询访问日志中的请求。有关使用 SQL 查询 S3 表类数据存储服务镜像，请参阅在 S3 表类数据存储服务中查询访问日志。

开始使用

  1. 通过 https://console.aws.amazon.com/cloudwatch/ 打开 CloudWatch 控制台。

  2. 在导航窗格中，选择日志，然后选择 Logs Insights。

  3. 从日志组选择器中选择服务器访问日志组。

  4. 选择查询的时间范围。

  5. 输入查询，然后选择运行查询。

流量分析

以下查询有助于您了解请求量和流量模式。

例一段时间内的请求量
stats count(*) as requests by bin(5m) as interval
| sort interval asc
例按操作类型划分的请求组合
stats count(*) as cnt by operation
| sort cnt desc
例按存储桶划分的流量
stats count(*) as requests, sum(bytes_sent_size) as bytes_out by bucket_arn
| sort requests desc

错误排查

以下查询有助于您识别和诊断错误。

例错误率细分
filter http_status >= 400
| stats count(*) as error_count by http_status, error_code, operation
| sort error_count desc
例 403 拒绝访问请求
filter http_status = 403
| stats count(*) as denied_count by key_name, remote_ip, requester
| sort denied_count desc
例 404 找不到请求
filter http_status = 404
| stats count(*) as miss_count by key_name, error_code, remote_ip
| sort miss_count desc
例 503 减速（节流）事件
filter http_status = 503
| stats count(*) as throttle_count by key_name, remote_ip
| sort throttle_count desc

访问模式

以下查询有助于您了解谁在访问您的数据以及如何访问您的数据。

例按源 IP 划分的流量
stats count(*) as total_requests,
  sum(http_status >= 400) as errors,
  sum(bytes_sent_size) as bytes_transferred
  by remote_ip
| sort total_requests desc
例请求者的操作
stats count(*) as requests by requester, operation
| sort requests desc
例最常访问的键
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats count(*) as access_count, sum(bytes_sent_size) as bytes_out by key_name
| sort access_count desc
| limit 10

延迟分析

以下查询有助于您识别缓慢的请求和延迟趋势。

例按操作类型划分的延迟
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats avg(total_duration) as avg_ms,
  pct(total_duration, 50) as p50_ms,
  pct(total_duration, 95) as p95_ms,
  max(total_duration) as max_ms,
  count(*) as requests
  by operation
例按照 p95 延迟划分的最慢键
filter operation like /REST\.GET\.OBJECT/
| stats avg(total_duration) as avg_ms,
  pct(total_duration, 95) as p95_ms,
  count(*) as requests
  by key_name
| sort p95_ms desc
| limit 10
例一段时间内的延迟
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats avg(total_duration) as avg_ms, pct(total_duration, 95) as p95_ms by bin(5m) as interval
| sort interval asc

成本归属

以下查询有助于您了解数据传输并确定成本驱动因素。

例按操作划分的数据传输
filter operation like /REST\.(GET|PUT|DELETE)\.OBJECT/
| stats sum(bytes_sent_size) as total_bytes_out,
  sum(object_size) as total_object_bytes,
  count(*) as request_count
  by operation
| sort total_bytes_out desc
例正在提供的最大对象
filter operation like /REST\.GET\.OBJECT/ and bytes_sent_size > 0
| stats max(object_size) as max_size, avg(object_size) as avg_size, count(*) as reads by key_name
| sort max_size desc
| limit 10

安全分析

以下查询有助于您检测可疑的访问模式。

例具有高错误率的 IP
stats count(*) as total,
  sum(http_status >= 400) as errors
  by remote_ip
| filter errors > 10
| sort errors desc
例按键划分的尝试访问失败
filter http_status >= 400
| stats count(*) as attempts by remote_ip, key_name, operation, http_status
| sort attempts desc
| limit 20
例 TLS 版本分配
stats count(*) as cnt by tls_version
| sort cnt desc