Log Analysis

AI-Starter outputs logs to Amazon CloudWatch Logs so you can monitor application behavior and usage. Analyzing these logs helps with troubleshooting and service improvement.

This page explains how to analyze logs using CloudWatch Logs Insights.

Analyzing Application Logs

CloudWatch Logs Insights provides a powerful query language that lets you analyze log data flexibly.

Steps

1. Sign in to the AWS Management Console.
2. In the Tokyo region, open the CloudWatch service page and choose Logs Insights from the sidebar.
3. Select the AI-Starter log group (/aws/ecs/<prefix>-app-service).
4. Choose the time range you want to analyze.
5. Enter a query suited to what you want to analyze in the query editor and run it.

Query Examples

Conversation Count

fields @timestamp, @message, user
| filter !isBlank(user)
| filter @message like /Saved/
| stats count(*) as total_count

This query aggregates the total number of saved conversations.

Chat Count per User

fields @timestamp, @message, user
| filter !isBlank(user)
| filter @message like /Saved/
| stats count(*) as chat_count by user
| sort chat_count desc

This query aggregates chat counts per user and lists them from most to least.

Assistant Usage Breakdown

fields @timestamp, @message, user, selectedAssistant.id, selectedAssistant.model
| filter !isBlank(user)
| filter @message like /Saved/
| stats count(*) as total by selectedAssistant.id, selectedAssistant.model
| sort total desc

This query aggregates usage counts per assistant and lists them from most to least used.

Feedback

fields @timestamp, userId, assistantId, assistantDisplayName, eventType, feedbackType, comment, @message
| filter eventType like 'user_feedback'

This query lists user feedback with rating and comment.

Filter by Log Level

Each log record carries a numeric level field that indicates its severity.

level value	Level	Purpose
10	trace	Most verbose tracing
20	debug	Debug information for development
30	info	Normal operation logs (chat saves, feedback, etc.)
40	warn	Warnings (processing continues)
50	error	Errors (operation failed but recoverable)
60	fatal	Fatal errors that stop the process

Note

By default in production, trace and debug logs are not emitted.

Debug Logs Only

fields @timestamp, @message, @logStream, @log
| filter level = 20
| sort @timestamp desc
| limit 100

This query shows only debug-level logs (level = 20), latest 100 entries first. Use it when you need detailed debug information.

Info and Above

fields @timestamp, @message, @logStream, @log
| filter level >= 30
| sort @timestamp desc
| limit 100

This query shows logs at info level or higher (level >= 30), latest 100 entries first. Use it to get an overview of application activity.

Warn and Above

fields @timestamp, @message, @logStream, @log
| filter level >= 40
| sort @timestamp desc
| limit 100

This query shows logs at warn level or higher (level >= 40), latest 100 entries first. Use it to focus on events that need attention.

Error and Above

fields @timestamp, @message, @logStream, @log
| filter level >= 50
| sort @timestamp desc
| limit 100

This query shows error and fatal-level logs (level >= 50), latest 100 entries first. It helps you investigate the context around errors.

Saving and Reusing Queries

CloudWatch Logs Insights lets you save frequently used queries so you can reuse them.

Saving a Query

1. Compose the query you want to save in the CloudWatch Logs Insights editor.
2. Click Save at the top of the screen.
3. In the Save new query dialog, enter a query name and click Save.

Note

• Choose a query name that clearly describes what the query does.
• Only the log group and the query text are saved. The time range is not saved.

Reusing a Saved Query

1. Open the CloudWatch Logs Insights query page.
2. Click the Queries icon on the right side of the screen.
3. Select the query you want to use under Saved queries.
4. The log group and the query text are loaded into the editor.
5. Adjust the time range as needed and click Run query.

Tips

• Saved queries can be edited or deleted at any time.
• Saving shared team queries streamlines analysis work.

Related Pages

• Architecture
• Setup