Skip to main content
Sumo Logic

Amazon ElastiCache

Amazon ElastiCache allows you to set up, run, and scale popular open-source compatible in-memory data stores in the cloud.

The Amazon ElastiCache dashboards provide visibility into key event and performance analytics that enable proactive diagnosis and response to system and environment issues. Use the preconfigured dashboards for at-a-glance analysis of event status trends, locations, successes and failures, as well as system health and performance metrics. The dashboards also have additional performance insights for Redis clusters.

Log and Metric Types

The Amazon ElastiCache app uses the following logs and metrics:

Sample CloudTrail Log Message

{"eventVersion":"1.05","userIdentity":{"type":"IAMUser","principalId":"AI1234567890QEWUABG5Q","arn":"arn:aws:iam::951234567898:user/Ankit Go","accountId":"951234567898","accessKeyId":"ABCDEFGHIHFBOT4FDVK","userName":"jschmo-sa","sessionContext":{"attributes":{"mfaAuthenticated":"true","creationDate":"2018-12-21T06:34:43Z"}},"invokedBy":"signin.amazonaws.com"},"eventTime":"2021-02-12 10:02:02.318+0000","eventSource":"elasticache.amazonaws.com","eventName":"ModifyReplicationGroupShardConfiguration","awsRegion":"us-east-1","sourceIPAddress":"72.242.40.178","userAgent":"signin.amazonaws.com","requestParameters":{"applyImmediately":true,"nodeGroupCount":3,"replicationGroupId":"nitin-redis-cluster1"},"responseElements":null,"requestID":"e7b3-0503-11e9-ac32-1b9dd4a2a030","eventID":"554d-7d55-46fe-a0fa-de886d19c846","eventType":"AwsApiCall","recipientAccountId":"951234567898"}

Query sample (Metric based)

Cache Hit Rate

account=dev region=us-east-1 namespace=aws/elasticache metric=CacheHitRate statistic=Average CacheClusterId=* CacheNodeId=* | avg by account, region, namespace, CacheClusterId, CacheNodeId

Query sample (CloudTrail Log based)  

Top 10 ReplicationGroupId's

account=dev region=us-east-1 namespace=aws/elasticache "\"eventSource\":\"elasticache.amazonaws.com\"" replicationGroupId
| json "userIdentity", "eventSource", "eventName", "awsRegion", "sourceIPAddress", "userAgent", "eventType", "recipientAccountId", "requestParameters", "responseElements", "requestID", "errorCode", "errorMessage" as userIdentity, event_source, event_name, region, src_ip, user_agent, event_type, recipient_account_id, requestParameters, responseElements, request_id, error_code, error_message nodrop
| where event_source = "elasticache.amazonaws.com" 
| json field=userIdentity "type", "principalId", "arn", "userName", "accountId" nodrop
| json field=userIdentity "sessionContext.attributes.mfaAuthenticated" as mfaAuthenticated nodrop
| json field=requestParameters "replicationGroupId", "engine", "engineVersion" as req_replicationGroupId, req_engine, req_engineVersion nodrop
| json field=responseElements "replicationGroupId", "engine", "engineVersion", "status" as res_replicationGroupId, res_engine, res_engineVersion, res_status nodrop
| if (isEmpty(req_replicationGroupId), res_replicationGroupId, req_replicationGroupId) as replicationgroupid
| where !isEmpty(replicationgroupid)
| parse field=arn ":assumed-role/*" as user nodrop  
| parse field=arn "arn:aws:iam::*:*" as accountId, user nodrop
| if (isEmpty(error_code), "Success", "Failure") as eventStatus
| if (isEmpty(userName), user, userName) as user
| if (isEmpty(req_engine), res_engine, req_engine) as engine
| if (isEmpty(req_engineVersion), res_engineVersion, req_engineVersion) as engine_version
| res_status as Status
| count as Count by replicationgroupid | sort by Count, replicationgroupid asc | limit 10