AWS CloudWatch: visualise more time series

Question

I would like to visualise event occurrence changes in time.

Use case:

• Let's say my logs contains 2 types of events (eventA, eventB).
• I'm interested in a line graph that shows the number of events per hours. (line#1: dataA1, dataA2... ; line#2: dataB1, dataB2...)

What I'm aware of:

• Query the logs: fields @timestamp, eventName | stats count() by bin(1h), eventName | sort bin(1h) asc fields @timestamp, eventName | stats count() by bin(1h), eventName | sort bin(1h) asc
• The above query gives all the data for creating the desired graph (eg: [bin(1h)], [count()], [eventName])
• If I remove the eventName field form display I get a log-table with the correct data, but the line graph is showing datapoints mixed (eg: dataA1, dataA2, dataB3, dataA4, dataB5)

The question:

• Is it possible to generate a line graph with more series in it?
• If yes, what parametrization do I need?

Answer 1

See https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_Insights-Visualizing-Log-Data.html

Visualizing time series data Time series visualizations work for queries with the following characteristics: The query contains one or more aggregation functions. For more information, see Aggregation Functions in the Stats Command. The query uses the bin() function to group the data by one field. These queries can produce line charts, stacked area charts, bar charts, and pie charts.

You can't use line chart for your example because you can only use single bin() grouping to produce time series. You can however use eg pie chart for your use case.

Alternatively if applicable to your use case, you can start producing logs in different format as

{
   "eventA": 1,
   "eventB": 0
}

Then you can write query as stats sum(eventA), sum(eventB) by bin(1h)