本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
# 使用 CloudWatch Logs Insights 查詢日誌
CloudWatch Logs Insights 可讓您以互動方式搜尋和分析伺服器存取日誌資料。查詢會針對交付日誌的日誌群組執行，並在幾秒鐘內傳回結果。
**注意**
如需查詢傳送到 Amazon S3 一般用途儲存貯體的日誌，請參閱 [使用 Amazon Athena 查詢請求的存取日誌](using-s3-access-logs-to-identify-requests.md#querying-s3-access-logs-for-requests)。如需使用 SQL 查詢 S3 Tables 鏡像，請參閱 [在 S3 資料表中查詢存取日誌](sal-cw-querying-s3tables.md)。
## 開始使用
1. 透過 [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/) 開啟 CloudWatch 主控台。
1. 在導覽窗格中，選擇**日誌**，然後選擇**日誌洞見**。
1. 從日誌群組選取器中選取您的伺服器存取日誌群組。
1. 為您的查詢選擇時間範圍。
1. 輸入查詢，然後選擇**執行查詢**。
## 流量分析
下列查詢可協助您了解請求量和流量模式。
**Example 隨著時間的推移請求磁碟區**
```
stats count(*) as requests by bin(5m) as interval
| sort interval asc
```
**Example 依操作類型請求混合**
```
stats count(*) as cnt by operation
| sort cnt desc
```
**Example 依儲存貯體的流量**
```
stats count(*) as requests, sum(bytes_sent_size) as bytes_out by bucket_arn
| sort requests desc
```
## 故障診斷錯誤
下列查詢可協助您識別和診斷錯誤。
**Example 錯誤率明細**
```
filter http_status >= 400
| stats count(*) as error_count by http_status, error_code, operation
| sort error_count desc
```
**Example 403 存取遭拒的請求**
```
filter http_status = 403
| stats count(*) as denied_count by key_name, remote_ip, requester
| sort denied_count desc
```
**Example 404 找不到請求**
```
filter http_status = 404
| stats count(*) as miss_count by key_name, error_code, remote_ip
| sort miss_count desc
```
**Example 503 SlowDown （調節） 事件**
```
filter http_status = 503
| stats count(*) as throttle_count by key_name, remote_ip
| sort throttle_count desc
```
## 存取模式
下列查詢可協助您了解誰正在存取您的資料以及如何存取您的資料。
**Example 依來源 IP 的流量**
```
stats count(*) as total_requests,
sum(http_status >= 400) as errors,
sum(bytes_sent_size) as bytes_transferred
by remote_ip
| sort total_requests desc
```
**Example 依請求者的操作**
```
stats count(*) as requests by requester, operation
| sort requests desc
```
**Example 最常存取的金鑰**
```
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats count(*) as access_count, sum(bytes_sent_size) as bytes_out by key_name
| sort access_count desc
| limit 10
```
## 延遲分析
下列查詢可協助您識別慢速請求和延遲趨勢。
**Example 依操作類型的延遲**
```
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats avg(total_duration) as avg_ms,
pct(total_duration, 50) as p50_ms,
pct(total_duration, 95) as p95_ms,
max(total_duration) as max_ms,
count(*) as requests
by operation
```
**Example p95 延遲的最慢金鑰**
```
filter operation like /REST\.GET\.OBJECT/
| stats avg(total_duration) as avg_ms,
pct(total_duration, 95) as p95_ms,
count(*) as requests
by key_name
| sort p95_ms desc
| limit 10
```
**Example 隨著時間推移的延遲**
```
filter operation like /REST\.(GET|PUT)\.OBJECT/
| stats avg(total_duration) as avg_ms, pct(total_duration, 95) as p95_ms by bin(5m) as interval
| sort interval asc
```
## 成本歸因
下列查詢可協助您了解資料傳輸並識別成本驅動因素。
**Example 依操作的資料傳輸**
```
filter operation like /REST\.(GET|PUT|DELETE)\.OBJECT/
| stats sum(bytes_sent_size) as total_bytes_out,
sum(object_size) as total_object_bytes,
count(*) as request_count
by operation
| sort total_bytes_out desc
```
**Example 正在服務的最大物件**
```
filter operation like /REST\.GET\.OBJECT/ and bytes_sent_size > 0
| stats max(object_size) as max_size, avg(object_size) as avg_size, count(*) as reads by key_name
| sort max_size desc
| limit 10
```
## 安全性分析
下列查詢可協助您偵測可疑的存取模式。
**Example 錯誤率較高的 IPs**
```
stats count(*) as total,
sum(http_status >= 400) as errors
by remote_ip
| filter errors > 10
| sort errors desc
```
**Example 依金鑰存取嘗試失敗**
```
filter http_status >= 400
| stats count(*) as attempts by remote_ip, key_name, operation, http_status
| sort attempts desc
| limit 20
```
**Example TLS 版本分佈**
```
stats count(*) as cnt by tls_version
| sort cnt desc
```