Search code examples
amazon-cloudwatchaws-cloudwatch-log-insights

Display empty bin as a zero value in AWS Log Insights graph

With this count query by bin:

filter @message like / error /
| stats count() as exceptionCount by bin(30m)

I get a discontinuous graph, which is hard to grasp:

Graph

Is is possible for AWS Cloudwatch Log Insights to consider the empty bin as zero count to get a continuous graph?

Solution

  • Found your question looking for my own answer to this.

    The best that I came up with is to calculate a 'presence' field and then use sum to get 0's in the time bins.

    I used strcontains, which returns a 1 when matched or 0 when not. https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html#CWL_QuerySyntax-operations-functions

    Mine looks like this:

    fields @timestamp, @message
| fields strcontains(@message, 'Exit status 1') as is_exit_message
| stats sum(is_exit_message) as is_exit_message_count by bin(15m) as time_of_crash
| sort time_of_crash desc

    So, yours would be:

    fields strcontains(@message, 'error') as is_error
| stats sum(is_error) as exceptionCount by bin(30m)