S
Size: a a a
S
KT
KT
MS
AT
AS
S
AS
S
fields @logStream, @message, @timestamp
| filter @logStream like 'apache/apache/'
| filter @message like /^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/
| parse @message /(?<@errcode>(\d+)) \d+$/
| fields strcontains(@errcode, "200") as @error200,
strcontains(@errcode, "500") as @error5xx
| stats sum(@error5xx) / (sum(@error200) + sum(@error5xx)) * 100 as errorrate by bin(30s)
| sort @timestamp desc
AS