AWS eks documentation change
Summary
Fixed CloudWatch Logs Insights query syntax by removing asterisks from field references in log analysis examples
Security assessment
Syntax corrections in monitoring queries without any security context. Changes appear to be documentation formatting fixes rather than security-related updates.
Diff
diff --git a/eks/latest/best-practices/control_plane_monitoring.md b/eks/latest/best-practices/control_plane_monitoring.md index 5037c8b15..523f3b0aa 100644 --- a//eks/latest/best-practices/control_plane_monitoring.md +++ b//eks/latest/best-practices/control_plane_monitoring.md @@ -111,2 +111,2 @@ An appropriate Count needs to be used as to not pull normal List/Resync behavior - fields *@timestamp*, *@message* - | filter *@logStream* like "kube-apiserver-audit" + fields @timestamp, @message + | filter @logStream like "kube-apiserver-audit" @@ -144,4 +144,4 @@ Since we do not have access to the above metric in EKS, we will use the below Cl - fields timestamp, pod, err, *@message* - | filter *@logStream* like "scheduler" - | filter *@message* like "Unable to schedule pod" - | parse *@message* /^.(?<date>\d{4})\s+(?<timestamp>\d+:\d+:\d+\.\d+)\s+\S*\s+\S+\]\s\"(.*?)\"\s+pod=(?<pod>\"(.*?)\")\s+err=(?<err>\"(.*?)\")/ + fields timestamp, pod, err, @message + | filter @logStream like "scheduler" + | filter @message like "Unable to schedule pod" + | parse @message /^.(?<date>\d{4})\s+(?<timestamp>\d+:\d+:\d+\.\d+)\s+\S*\s+\S+\]\s\"(.*?)\"\s+pod=(?<pod>\"(.*?)\")\s+err=(?<err>\"(.*?)\")/ @@ -246,4 +246,4 @@ If you want to see start/end times of defrag use the following query: - fields *@timestamp*, *@message* - | filter *@logStream* like /etcd-manager/ - | filter *@message* like /defraging|defraged/ - | sort *@timestamp* asc + fields @timestamp, @message + | filter @logStream like /etcd-manager/ + | filter @message like /defraging|defraged/ + | sort @timestamp asc