I've created a metric filter just to get an idea about how many times a specific log pattern shows up, nothing crazy. Metric value is set to 1 and Default value is set to 0. Since it's not a high-resolution metric, CloudWatch is aggregating it in a minute period. All good with that.
What I do not understand is the difference between the Sum and Sample Count statistics. Why Sum and Sample Count would have different values?
- If we assume that there was no record in the 1-minute interval with the filter pattern,
Sum would be 0, and Sample Count would be 0.
- If we assume that there was at least one record in the 1-minute interval with the filter pattern,
Sum would be X, and Sample Count would be X, where X is greater than 0.
An example:
Let's say I created a metric filter with the pattern "ERROR:", and I set Metric value is set to 1 and Default value is set to 0.
We have the following logs for three different log streams under the same log group in a specific minute in the timeline:
Log stream 1:
- ERROR: XXXXXXX
- INFO: XXXXXX
Log stream 2:
- INFO: XXXXXX
- INFO: XXXXXX
Log stream 3:
- ERROR: XXXXXXX
- ERROR: XXXXXXX
- ERROR: XXXXXXX
What would be the values for Sum and Sample Count in your opinion? 4, right!?
