CloudWatch: count number of requests from cloudwatch logs and create alarm

Question

I am logging userid in cloudwatch logs and need to count the no. of requests for the same userid in last 1 hour and have to create an alarm. Basically need to do that for each userid. So is there a way we can achieve this using Cloudwatch metric? Or any other AWS service?

Answer

If I understood your requirement correctly you have a log group that captures records of user logging which includes the userid field and you need to set an alarm if one or many of these userids if they reach a certain threshold within an hour.

I would suggest creating a metric filter on your log group as described here -> [https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateMetricFilterProcedure.html]()

Then setup a cloudwatch alarm based on the metric filter you created -> [https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_alarm_log_group_metric_filter.html]()

CloudWatch: count number of requests from cloudwatch logs and create alarm

Relevant content