Coralogix reporter allows you to automate the generation of a periodic report that includes the formatted results of a predefined query. This report can be distributed automatically to a mailing list.
To define and set up a report go to AWS’s Serverless Application Repository and search for ‘Coralogix’. Click on the link to ‘Coralogix-Elasticsearch-Reporter’.
The application requires the following parameters:
Don’t change the memory size and function timeout parameters. You can adjust the query timeout based on your needs.
Report example:
Queries the account every day at 08:00 to find mapping exceptions:
Elasticsearch query:
{"size":0,"query":{"bool":{"filter":[{"query_string":{"query":"_exists_:coralogix.failed_reason"}},{"range":{"coralogix.timestamp":{"gte":"now-24h","lt":"now"}}}]}},"aggs":{"exceptions":{"terms":{"field":"coralogix.failed_reason","size":20}}}}
Schedule:
cron(0 0 */8 ? * *)
Template:
aggregations.exceptions.buckets[*].{"Exception":key,"Count":doc_count}