aws-cloudwatch-investigation

1# AWS CloudWatch Investigation Skill
2 
3Reusable patterns for investigating production incidents using CloudWatch Logs, Metrics, and Alarms. These patterns are designed to be composed together during incident triage.
4 
5---
6 
7## Pattern 1: Logs Insights Query Templates
8 
9### Error Spike Detection
10 
11Find the top errors in a time window, grouped by error type:
12 
13```
14fields @timestamp, @message, @logStream
15| filter @message like /(?i)(error|exception|fatal|critical)/
16| stats count(*) as errorCount by bin(5m), @logStream
17| sort errorCount desc
18| limit 20
19```
20 
21### P99 Latency Breakdown by Operation
22 
23Identify which operations are driving latency spikes:
24 
25```
26fields @timestamp, @duration, operation
27| filter ispresent(@duration)
28| stats avg(@duration) as avgMs,
29        pct(@duration, 50) as p50Ms,
30        pct(@duration, 95) as p95Ms,
31        pct(@duration, 99) as p99Ms,
32        count(*) as invocations
33  by operation
34| sort p99Ms desc
35| limit 15
36```
37 
38### Lambda Cold Start Detection
39 
40Quantify cold start impact during an incident:
41 
42```
43fields @timestamp, @duration, @initDuration, @memorySize, @maxMemoryUsed
44| filter ispresent(@initDuration)
45| stats count(*) as coldStarts,
46        avg(@initDuration) as avgInitMs,
47        max(@initDuration) as maxInitMs,
48        avg(@duration) as avgDurationMs
49  by bin(5m)
50| sort @timestamp desc
51```
52 
53### Out-of-Memory (OOM) Detection
54 
55Find Lambda functions or containers killed by memory pressure:
56 
57```
58…