AWS CloudWatch Logs Insights クエリチートシート

※parseはログのフォーマットによって読み替えが必要です。

---

1. エラー(直近20件)

fields @timestamp, @logStream, @message
| filter @message like /ERROR|Exception/
| sort @timestamp desc
| limit 20

---

2. エラー数推移(5分毎)

filter @message like /ERROR|Exception/
| stats count() by bin(5m)

---

3. 5xxエラー一覧

fields timestamp, message
| parse message "* * * * *ms *" as method, path, status, size, duration, clientIp
| filter status like /^5/
| sort timestamp desc

---

4. 例外毎の集計

parse @message /(?<exception>[A-Za-z0-9.]+Exception)/
| stats count() by exception
| sort count desc

---

5. HTTPステータスコード別集計

fields message
| parse message "* * * * *ms *" as method, path, status, size, duration, clientIp
| stats count() as requests by status
| sort status asc

#	status	requests
1	200	16873
2	400	43
3	401	3
4	404	88

---

6. API毎のP95レスポンス時間

P95: 95パーセンタイル。全リクエストの95%はこの時間以内に完了しているという、レスポンス時間の分布を見るための指標。

10000リクエスト
平均: 30ms
P95: 80ms
P99: 500ms
最大: 5000ms

であれば、

95%のリクエスト -> 80ms以内(良好)

1%程度 -> 500ms以上(調査対象)

一部 -> 5秒級の異常あり

という判断。

fields timestamp, message
| parse message "* * * * *ms *" as method, path, status, size, duration, clientIp
| stats
    count() as requests,
    avg(duration) as avg_ms,
    pct(duration,95) as p95_ms,
    max(duration) as max_ms
by method, path
| sort p95_ms desc

#	method	path	requests	avg_ms	p95_ms	max_ms
1	GET	/example/contacts	45	326.1556	831	4985
2	POST	/example/count	11	282.0909	775	775
3	GET	/example/activities	101	327	583	1454
4	POST	/example/view	34	98.7059	532	1061

---

7. 遅いAPIランキング(1秒以上)

fields @timestamp, message
| parse message "* * * * *ms *" as p_method, p_path, p_status, p_size, p_duration, p_clientIp
| filter p_duration >= 1000
| display @timestamp, p_method, p_path, p_duration, p_status
| sort p_duration desc

#	@timestamp	p_method	p_path	p_duration	p_status
1	2026-07-31T01:23:45.472+09:00	GET	/example/contacts	5292	200
2	2026-07-31T13:56:22.212+09:00	POST	/example/count	5021	200
3	2026-07-31T08:09:13.195+09:00	GET	/example/activities	4618	200
4	2026-07-31T11:34:45.673+09:00	POST	/example/view	3022	200

---

8. 特定APIの遅い順ランキング(TOP20)

e.g. /example/contacts

fields @timestamp, @message
| filter @message like /example\/contacts/
| parse @message /\s(?<status>\d{3})\s+\d+bytes\s+(?<responseTimeMs>\d+)ms\s+(?<remoteIp>\S+)/
| filter ispresent(responseTimeMs)
| sort responseTimeMs desc
| limit 20

---

9. 呼び出し回数が多いAPI(TOP20)

fields message
| parse message "* * * * *ms *" as method, path, status, size, duration, clientIp
| stats count() as requests by method, path
| sort requests desc
| limit 20

#	method	path	requests
1	GET	/example/contacts	1232
2	POST	/example/count	1069
3	GET	/example/activities	648
4	POST	/example/view	529

---

よく使う関数

関数	用途
stats	集計
count()	件数
avg()	平均
pct()	P95/P99
bin()	時系列
parse	ログ分解
filter	絞り込み
sort	ランキング
limit	件数制限
toNumber()	数値化