AWS cloudwatch log alarm which steps should I be looking at ?

1. Create a CloudWatch Log Group: Ensure your camera logs are being sent to a CloudWatch Log Group.

2. Create Metric Filters: You'll need to create two metric filters for each camera:

   • One to detect when a camera goes offline
   • Another to detect when a camera comes back online

   The filter pattern for offline events would look something like: [date, time, ..., cameraid="testc00013.test0001ev", ..., message="Device communication error"]

   And for online events: [date, time, ..., cameraid="testc00013.test0001ev", ..., message="Device communication established"]

   You'll need to create these filters for each unique camera ID.

3. Create Custom Metrics: When creating the metric filters, assign each a custom metric name. For example:

   • CameraOffline_testc00013_test0001ev
   • CameraOnline_testc00013_test0001ev

4. Create CloudWatch Alarms: For each camera, create an alarm that triggers if the camera is offline for more than 5 minutes. You can do this by:

   • Using the "CameraOffline" metric as the alarm trigger
   • Setting the threshold to 1 (indicating an offline event occurred)
   • Setting the evaluation period to 5 minutes
   • Using the "CameraOnline" metric to reset the alarm

5. Set up Notifications: Configure Amazon SNS (Simple Notification Service) to send notifications when alarms are triggered.

To implement this for hundreds of cameras, you may want to consider automating the process:

1. Use CloudWatch Logs Insights to query and identify all unique camera IDs in your logs.

2. Create a script or use AWS CloudFormation to automatically generate the necessary metric filters, custom metrics, and alarms for each camera ID.

3. Use AWS Lambda in combination with CloudWatch Events to dynamically create new alarms when new camera IDs are detected in the logs.

This approach allows you to create individual alarms for each camera, monitoring their offline status and alerting you if they don't come back online within 5 minutes. The automation suggestions can help manage this at scale for hundreds of cameras.
Sources
Alarming on logs - Amazon CloudWatch
Use CloudWatch alarms to monitor CloudTrail events | AWS re:Post
AWS announces CloudWatch Logs Anomaly Detection and Pattern analysis

Hello Andy, I saw your comment on the re:Post Agent post. Could you please share with me why the solution proposed does not work for you?