[自分用メモ]

CloudformationテンプレートでMetricsFilterでメトリクスを作成し、そのメトリクスを使用してアラートを作成

1.MetricsFilter

logs.yml

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  # CloudWatch Log Group for RDS logs
  RDSLogGroup:
    Type: "AWS::Logs::LogGroup"
    Properties:
      LogGroupName: "/aws/rds/instance-logs"
      RetentionInDays: 14  # Retain logs for 14 days

  # Metric Filter for RDS Instance ID and Swap Total
  MetricFilterInstanceIdAndSwapTotal:
    Type: "AWS::Logs::MetricFilter"
    Properties:
      LogGroupName: !Ref RDSLogGroup
      FilterPattern: "{ $.instanceId = *, $.swapTotal = * }"
      MetricTransformations:
        - MetricValue: "1"
          MetricNamespace: "RDSMetrics"
          MetricName: "RDSInstanceId"
        - MetricValue: "$.swapTotal"
          MetricNamespace: "RDSMetrics"
          MetricName: "SwapTotal"

  # Metric Filter for Swap Usage Amount
  MetricFilterSwapUsage:
    Type: "AWS::Logs::MetricFilter"
    Properties:
      LogGroupName: !Ref RDSLogGroup
      FilterPattern: "{ $.instanceId = *, $.swapUsed = * }"
      MetricTransformations:
        - MetricValue: "$.swapUsed"
          MetricNamespace: "RDSMetrics"
          MetricName: "SwapUsageAmount"

Outputs:
  RDSLogGroupName:
    Description: "Name of the CloudWatch Log Group for RDS logs."
    Value: !Ref RDSLogGroup

2.Alarm

alarm.yml

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  # CloudWatch Alarm for MetricMath (Total - Used)
  MetricMathAlarm:
    Type: "AWS::CloudWatch::Alarm"
    Properties:
      AlarmName: "SwapTotalMinusUsed"
      AlarmDescription: "Alarm when the difference between swap total and used exceeds threshold."
      Namespace: "RDSMetrics"
      MetricName: "SwapTotalMinusUsed"
      ComparisonOperator: "GreaterThanThreshold"
      Threshold: 0
      EvaluationPeriods: 1
      DatapointsToAlarm: 1
      TreatMissingData: "missing"
      Metrics:
        - Id: "total"
          MetricStat:
            Metric:
              Namespace: "RDSMetrics"
              MetricName: "SwapTotal"
            Period: 300
            Stat: "Sum"
        - Id: "used"
          MetricStat:
            Metric:
              Namespace: "RDSMetrics"
              MetricName: "SwapUsageAmount"
            Period: 300
            Stat: "Sum"
        - Id: "mathExpression"
          Expression: "total - used"
          Label: "SwapTotalMinusUsed"
          ReturnData: true