cloudwatch Insights Useful Queries

count by device version (roughly)

fields @timestamp, @message, @device
| parse @message '* (*) - - [*] "* * *" * * "*" "* (*) * (*) *"' as local, remote, date, method, call, protocol, status, bytes, url, web, device, kit, gecko, mob
| filter call like "/api/answer/"
| filter method = "POST"
| sort @timestamp desc
| stats count(*) as total by substr(device, 0,24) 
| sort total desc

find_answerings_from_httpd

fields @timestamp, @message
| parse @message '* (*) - - [*] "POST /api/answer/*/ * * * "-" "* (*) * (*) *"' as local, remote, date, answer_id, protocol, status, bytes, web, device, kit, gecko, mob
| filter @message like "POST /api/answer/"
| sort @timestamp desc
| limit 100000

parse apache error log

 parse @message '[* * * * *] [*] [pid *] *' as day, month, date, time, year, error_type, pid, err_msg
| sort @timestamp desc
| limit 100

parse apache logs

fields @timestamp, @message
| parse @message '* (*) - - [*] "* * *" * * "*" "* (*) * (*) *"' as local, remote, date, method, call, protocol, status, bytes, url, web, device, kit, gecko, mob
| filter @message like "POST /api/answer/"
| sort @timestamp desc
| limit 1000

parse progress points log

fields @timestamp
| parse @message "* * * Populating progress points for Learner *" as level, date, time, learner
| filter level="DEBUG"
| stats count(*) as num_processed by bin(1m)
| sort num_processed desc
| limit 10000