0

Using CloudWatch logs insights I am trying to find the number of users who have interacted with my service more than 5 times. I have extracted the @userId field from my logs.

stats count(*) as used by @userId
| filter used>5

Using this query I am getting all the users but I want to get the count of such users rather than the users themselves. So I tried

stats count(*) as used by @userId
| filter used>5
| stats count(*)

but that gives an error probably because we cannot use stats twice in the same query (not sure of the reason). Looking for a way to get the required data.

pojo
  • 11
  • 2

2 Answers2

0

CloudWatch logs would not be able to do this, it could the number of records returned as the metric.

If this is the number of users that have ever touched the application I feel like incrementing the value in a KVS (Such as ElastiCache Redis or DynamoDB).

If this is within a set period I would recommend using Kinesis Data Analytics with a post action of push to Lambda to do any reporting/alerting (either directly to SNS or via CloudWatch custom metric).

Chris Williams
  • 32,215
  • 4
  • 30
  • 68
0

Pretty hacky, but running a few queries should be good enough if the total number of matches is within the low 10s of thousands:

  • query 1 stats count() as used by @userId | filter 5 < used | sort used desc | limit 10000

If there are more than 10000 results, observe the row count and second lowest used value, x, at the bottom of the results. Then run another query substituting x:

  • query 2 stats count() as used by @userId | filter 5 < used and used < x | sort used desc | limit 10000

Assuming you only needed to run two queries, add the row count from query 1 to query 2.

gangreen
  • 849
  • 7
  • 9