# 使用 CloudWatch Logs Insights 查询日志
CloudWatch Logs Insights 可让您以交互方式搜索和分析您的服务器访问日志数据。查询会针对发送日志的日志组运行，并在几秒钟内返回结果。
**注意**
有关查询传输到 Amazon S3 通用存储桶的日志，请参阅[使用 Amazon Athena 查询访问日志中的请求](using-s3-access-logs-to-identify-requests.md#querying-s3-access-logs-for-requests)。有关使用 SQL 查询 S3 表类数据存储服务镜像，请参阅[在 S3 表类数据存储服务中查询访问日志](sal-cw-querying-s3tables.md)。
## 开始使用
1. 通过 [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/) 打开 CloudWatch 控制台。
1. 在导航窗格中，选择**日志**，然后选择 **Logs Insights**。
1. 从日志组选择器中选择服务器访问日志组。
1. 选择查询的时间范围。
1. 输入查询，然后选择**运行查询**。
## 流量分析
以下查询有助于您了解请求量和流量模式。
**Example 一段时间内的请求量**
```
stats count(*) as requests by bin(5m) as interval
| sort interval asc
```
**Example 按操作类型划分的请求组合**
```
stats count(*) as cnt by operation
| sort cnt desc
```
**Example 按存储桶划分的流量**
```
stats count(*) as requests, sum(bytes_sent_size) as bytes_out by bucket_arn
| sort requests desc
```
## 错误排查
以下查询有助于您识别和诊断错误。
**Example 错误率细分**
```
filter http_status >= 400
| stats count(*) as error_count by http_status, error_code, operation
| sort error_count desc
```
**Example 403 拒绝访问请求**
```
filter http_status = 403
| stats count(*) as denied_count by key_name, remote_ip, requester
| sort denied_count desc
```
**Example 404 找不到请求**
```
filter http_status = 404
| stats count(*) as miss_count by key_name, error_code, remote_ip
| sort miss_count desc
```
**Example 503 减速（节流）事件**
```
filter http_status = 503
| stats count(*) as throttle_count by key_name, remote_ip
| sort throttle_count desc
```
## 访问模式
以下查询有助于您了解谁在访问您的数据以及如何访问您的数据。
**Example 按源 IP 划分的流量**
```
stats count(*) as total_requests,
sum(http_status >= 400) as errors,
sum(bytes_sent_size) as bytes_transferred
by remote_ip
| sort total_requests desc
```
**Example 请求者的操作**
```
stats count(*) as requests by requester, operation
| sort requests desc
```
**Example 最常访问的键**
```
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats count(*) as access_count, sum(bytes_sent_size) as bytes_out by key_name
| sort access_count desc
| limit 10
```
## 延迟分析
以下查询有助于您识别缓慢的请求和延迟趋势。
**Example 按操作类型划分的延迟**
```
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats avg(total_duration) as avg_ms,
pct(total_duration, 50) as p50_ms,
pct(total_duration, 95) as p95_ms,
max(total_duration) as max_ms,
count(*) as requests
by operation
```
**Example 按照 p95 延迟划分的最慢键**
```
filter operation like /REST\.GET\.OBJECT/
| stats avg(total_duration) as avg_ms,
pct(total_duration, 95) as p95_ms,
count(*) as requests
by key_name
| sort p95_ms desc
| limit 10
```
**Example 一段时间内的延迟**
```
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats avg(total_duration) as avg_ms, pct(total_duration, 95) as p95_ms by bin(5m) as interval
| sort interval asc
```
## 成本归属
以下查询有助于您了解数据传输并确定成本驱动因素。
**Example 按操作划分的数据传输**
```
filter operation like /REST\.(GET|PUT|DELETE)\.OBJECT/
| stats sum(bytes_sent_size) as total_bytes_out,
sum(object_size) as total_object_bytes,
count(*) as request_count
by operation
| sort total_bytes_out desc
```
**Example 正在提供的最大对象**
```
filter operation like /REST\.GET\.OBJECT/ and bytes_sent_size > 0
| stats max(object_size) as max_size, avg(object_size) as avg_size, count(*) as reads by key_name
| sort max_size desc
| limit 10
```
## 安全分析
以下查询有助于您检测可疑的访问模式。
**Example 具有高错误率的 IP**
```
stats count(*) as total,
sum(http_status >= 400) as errors
by remote_ip
| filter errors > 10
| sort errors desc
```
**Example 按键划分的尝试访问失败**
```
filter http_status >= 400
| stats count(*) as attempts by remote_ip, key_name, operation, http_status
| sort attempts desc
| limit 20
```
**Example TLS 版本分配**
```
stats count(*) as cnt by tls_version
| sort cnt desc
```