Search code examples
amazon-cloudwatchaws-cloudwatch-log-insights

In Amazon Cloudwatch Insights, how do you take a statistic of a statistic?


I am using AWS Cloudwatch Insights and running a query like this:

fields @message, @timestamp
| filter strcontains(@message, "Something of interest happened")
| stats count() as interestCount by bin(10m) as tenMinuteTime
| stats max(interestCount) by datefloor(tenMinuteTime, 1d)

However, on the last line, I get the following error:

mismatched input 'stats' expecting {K_PARSE, K_SEARCH, K_FIELDS, K_DISPLAY, K_FILTER, K_SORT, K_ORDER, K_HEAD, K_LIMIT, K_TAIL}

It would seem to mean from this that I cannot take multiple layers of stat queries in Insights, and thus cannot take a statistic of a statistic. Is there a way around this?


Solution

  • The accepted answer is out of date. As of November 2023, you can use up to two stats commands in the same query! Find documentation in the CloudWatch User Guide. For example (taken from those docs):

    STATS count_distinct(client_ip) AS session_ips, 
          count(*) AS requests BY session_id, client_platform
    | FILTER session_ips > 1
    | STATS count(*) AS multiple_ip_sessions, 
            sum(requests) / count(*) AS avg_session_requests BY client_platform