如何在CloudWatch中统计唯一事件类型及展示唯一日志消息

你的需求是对eventType和对应的mismatch值（假设对应日志解析后的rdmError字段）的唯一组合去重计数，相同组合仅算1次。修改后的查询如下：

fields @timestamp, @message
| sort @timestamp desc
| filter @message like 'RDMErrors::'
| parse @message "[*] *" as LType, LMessage
| filter LType!= 'Error'
| parse @message 'RDMErrors::*::*::Type3::*:*' as eventType, identfier, name, rdmError
# 按eventType和rdmError去重后，统计每个eventType下的唯一组合数量
| dedup eventType, rdmError
| stats count(*) as uniqueCombinationCount by eventType

如果需要直接列出所有唯一的eventType+rdmError组合，可改用：

fields @timestamp, @message
| sort @timestamp desc
| filter @message like 'RDMErrors::'
| parse @message "[*] *" as LType, LMessage
| filter LType!= 'Error'
| parse @message 'RDMErrors::*::*::Type3::*:*' as eventType, identfier, name, rdmError
| dedup eventType, rdmError
| display eventType, rdmError

当前查询会输出所有符合条件的LMessage（含重复项），要仅展示唯一消息，需添加dedup命令去重：

fields @timestamp, @message
| sort @timestamp desc
| filter @message like 'RDMErrors::Both::'
| parse @message "[*] *" as LType, LMessage
| filter LType= 'Error'
# 去重相同的LMessage，仅保留第一条记录
| dedup LMessage
| display LMessage

如果需要同时查看每条唯一消息的出现次数，可改用：

fields @timestamp, @message
| sort @timestamp desc
| filter @message like 'RDMErrors::Both::'
| parse @message "[*] *" as LType, LMessage
| filter LType= 'Error'
| stats count(*) as occurrenceCount by LMessage
| display LMessage, occurrenceCount

内容的提问来源于stack exchange，提问作者aak