InsightRule

Source: src/AWS/CloudWatch/InsightRule.ts

A CloudWatch Contributor Insights rule — analyzes log group entries to surface the top-N contributors (IPs, user IDs, …) to a metric derived from structured logs.

Creating Insight Rules

const rule = yield* InsightRule("TopContributors", {
  RuleState: "ENABLED",
  RuleDefinition: {
    Schema: {
      Name: "CloudWatchLogRule",
      Version: 1,
    },
    LogGroupNames: ["/my-app/access-logs"],
    LogFormat: "JSON",
    Contribution: {
      Keys: ["$.ip"],
    },
    AggregateOn: "Count",
  },
});

Reading Reports at Runtime

// init — bind the rule to the function (see GetInsightRuleReport)
const getInsightRuleReport = yield* AWS.CloudWatch.GetInsightRuleReport(rule);

// runtime
const now = yield* Effect.sync(() => Date.now());
const report = yield* getInsightRuleReport({
  StartTime: new Date(now - 3_600_000),
  EndTime: new Date(now),
  Period: 300,
});