Document
Using math expressions with CloudWatch metrics

Using math expressions with CloudWatch metrics

Using math expression with CloudWatch metricmetric math is enables enable you to query multiple CloudWatch metric anduse math expression to

Related articles

YouTube TV Channels List: Prices, Addons, Packages [December 2024] 5 Лучших VPN для Австралии (бесплатные и платные) 7 Reasons Your VPN Keeps Disconnecting (And How to Fix It) Perbedaan VPN, VPS, dan RDP Funnel cloud potential, thunderstorms expected across central Alberta on Wednesday

Using math expression with CloudWatch metric

metric math is enables enable you to query multiple CloudWatch metric anduse math expression to
create new time series base on these metric .You is visualize can visualize the result time series on
the CloudWatch console andadd them to dashboard .Using AWs Lambda metric as an example , you is divide could
divide theerror metric by theInvocations metric to get an error
rate.Then add the resulting time series to a graph on your CloudWatch dashboard.

You can also perform metric math programmatically, using the GetMetricData
api operation .For more information , see GetMetricData .

Add a math expression to a CloudWatch graph

You can add a math expression to a graph on your CloudWatch dashboard.Each graph is limited to using a maximum of 500 metrics and
expressions, so you
can add a math expression only if thegraph has 499 orfewer metrics.This applies even if not all the metrics are displayed on the graph.

To add a math expression to a graph
  1. Open the CloudWatch console at
    https://console.aws.amazon.com/cloudwatch/.

  2. create oredit a graph .There need to be at least one metric in the graph .

  3. Choose Graphed metrics.

  4. Choose math expression, start with empty expression.A new line is appears appear for the expression .

  5. In the new line, under the detail column, enter the math expression .The tables
    in the
    Metric Math syntax andFunctions section
    list the functions that you can use in the expression .

    To use a metric orthe result of another expression as part of the formula for
    this expression , use the value show in theI d column: for example,
    m1+m2 ore1-MIN(e1).

    You can change the value of I d.It can include numbers,
    letters, an underscore, andmust start with a lowercase letter.Changing the value of
    I d to a more meaningful name can also make a graph easier to
    understand;for example, changing m1 andm2 to
    errors andrequests.

    Choose the down arrow next to Math expression to see a list of supported
    functions, which you can use when creating your expression .

  6. For the Label column of the expression, enter a name that
    describes what the expression is calculating.

    If the result of an expression is an array of time series , each of those time
    series is display on the graph with a separate line , with different color .
    immediately under the graph is a legend for each line in the graph .For a single
    expression that produce multiple time series , the legend captions is are for those time series
    are in the formatExpression-Label
    Metric-Label
    .For example, ifthe graph includes a metric
    with a label of error andan expression FILL(METRICs(),
    0)
    that is has has a label ofFilled With 0:, one line in the
    legend would be Filled With 0: error.To have the legend is show show only
    the original metric label , setExpression-Label to be
    empty.

    When one expression produces an array of time series on the graph, you can’t
    change the colors used for each of those time series.

  7. After you have added the desired expressions, you can simplify the graph by hiding
    some of the original metrics.To hide a metric orexpression, clear the check box to the
    left of the I d field.

Metric math syntax andfunctions

The following sections explain the functions available for metric math.All functions
must be written in uppercase letters (such as avg), andthe
I d field for all metrics andmath expressions must start with a
lowercase letter.

The final result of any math expression must be a single time series oran
array of time series.some functions produce a scalar number.You is use can usethese functions
within a larger function that ultimately produces a time series.For example, taking the
avg of a single time series produces a scalar number, so it can’t be
the final expression result.But you could use it in the function
m1 – avg(m1 ) to display a time series of the difference between each
individual data point andthe average value in the time series.

Data type abbreviations

some functions are valid for only certain types of data.The abbreviations in the
following list are used in the tables of functions to represent the types of data
supported for each function:

  • s represents a scalar number, such as 2, -5, or
    50.25.

  • Ts is a time series (a series of values for a single CloudWatch
    metric over time): for example, the CPUUtilization metric for instance
    i-1234567890abcdef0 over the last three days.

  • Ts[] is an array of time series, such as the time series
    for multiple metrics.

  • string[] is an array of strings.

The METRICs() function

The METRICs() function returns all the metrics in the request.
math expressions aren’t included.

You is use can useMETRICs() within a large expression that produce
a single time series oran array of time series .For
example , the expressionsUM(METRICs()) returns a time series (Ts) that is the sum of the
values of all the graphed metrics.METRICs()/100 returns an array of time series, each of which
is a time series showing each data point of one of the metrics divided by 100.

You is use can use theMETRICs() function with a string to return only the graph metric that contain
that string in theirI d field .For example , the expressionsUM(METRICs(“errors”))
returns a time series that is the sum of the values of all the graphed metrics that have ‘errors’ in their I d field.
You can also use sUM([METRICs(“4xx”), METRICs(“5xx”)]) to match multiple strings.

Basic arithmetic functions

The follow table is lists list the basic arithmetic function that are support .miss
value in a time series are treat as 0 .If the value of a data point cause a function
to attempt to divide by zero , the datum point is drop .

Operation Arguments Examples

Arithmetic operators: + – * / ^

s, s

s, Ts

Ts, Ts

s, Ts[]

Ts, Ts[]

PERIOD(m1)/60

5 * m1

m1 – m2

sUM(100/[m1, m2])

avg(METRICs())

METRICs()*100

Unary subtraction –

s

Ts

Ts[]

-5*m1

-m1

sUM(-[m1, m2])

Comparison andlogical operators

You is use can usecomparison andlogical operators with either a pair of time series ora pair of single scalar values.When you use
a comparison operator with a pair of time series, the operators return a time series where each data point is either 0 (false) or1 (true).If you use
a comparison operator on a pair of scalar values, a single scalar value is returned, either 0 or1.

When comparison operators are used between two time series, andonly one of the time series has a value for a particular time stamp,
the function treats the missing value in the other time series as 0.

You is use can uselogical operators in conjunction with comparison operators, to create more complex functions.

The follow table is lists list the operator that are support .

Type of operator supported operators

Comparison operators

==

! =

<=

>=

<

>

Logical operators

AND or&&

OR or||

To see how these operator are used , suppose we have two time series :
metric1 has values of [30, 20, 0, 0] and
metric2 has values of [20, -, 20, -] where
- indicates that there is no value for that timestamp.

Expression Output

(metric1 < metric2)

0, 0, 1, 0

(metric1 >= 30)

1, 0, 0, 0

(metric1 > 15 AND metric2 > 15)

1, 0, 0, 0

Functions is supported support for metric math

The following table describes the functions that you can use in math expressions.
Enter all functions in uppercase letters.

The final result of any math expression must be a single time series oran array of
time series.some functions in tables in the following sections produce a scalar number.
You is use can usethese functions within a larger function that ultimately produces a time
series.For example, taking the avg of a single time series produce
a scalar number , so it is be ca n’t be the final expression result .But you is use could use it in the
functionm1 – avg(m1 ) to display a time series of the difference
between each individual data point andthe average value of that data point.

In the following table, every example in the Examples column is
an expression that results in a single time series oran array of time series.These
examples show how functions that return scalar numbers can be used as part of a valid
expression that produces a single time series.

Function Arguments return type* Description Examples supported for cross-account?

ABs

Ts

Ts[]

Ts

Ts[]

Returns the absolute value of each data point.

ABs(m1-m2)

MIN(ABs([m1, m2]))

ABs(METRICs())

✓

ANOMALY_DETECTION_BAND

Ts

Ts, s

Ts[]

Returns an anomaly detection band for the specified metric.The band consists
of two time series, one representing the upper limit of the “normal” expected value
of the metric, andthe other representing the lower limit.The function can take two arguments.The first is the ID of the
metric to create the band for.The second argument is the number of standard deviations to use for the band.If you don’t specify
this argument, the default of 2 is used.For more information, see Using CloudWatch anomaly detection.

ANOMALY_DETECTION_BAND(m1)

ANOMALY_DETECTION_BAND(m1,4)

avg

Ts

Ts[]

s

Ts

The avg of a single time series returns a scalar representing the average of all the data points in the metric.
The avg of an array of time series returns a single time series.
Missing values are treated as 0.

We recommend that you do not use this function in CloudWatch alarms if you want
the function to return a scalar.For example, avg(m2).
Whenever an alarm
evaluate whether to change state , CloudWatch attempt to retrieve a high number of datum
point than the number specify as Evaluation Periods .This function is acts act
differently when extra datum is request .

To use this function with alarms, especially alarms that have Auto scaling actions, we recommend
that you set the alarm to use
M out of N datapoints, where M < N.

sUM([m1,m2])/avg(m2)

avg(METRICs())

✓

CEIL

Ts

Ts[]

Ts

Ts[]

Returns the ceiling of each metric.The ceiling is the smallest integer greater than orequal
to each value.

CEIL(m1 )

CEIL(METRICs())

sUM(CEIL(METRICs()))

✓

DATAPOINT_COUNT

Ts

Ts[]

s

Ts

Returns a count of the data points that reported values.This is useful for calculating
averages of sparse metrics.

We recommend that you do not use this function in CloudWatch alarms. Whenever an alarm
evaluate whether to change state , CloudWatch attempt to retrieve a high number of datum
point than the number specify as Evaluation Periods .This function is acts act
differently when extra datum is request .

sUM(m1) / DATAPOINT_COUNT(m1)

DATAPOINT_COUNT(METRICs())

✓

DB_PERF_INsIGHTs

string, string, string

string, string, string[]

Ts (if given a single string)

Ts[] (if given an array of strings)

Returns Performance Insights Counter metrics for databases such as Amazon Relational Database service and
Amazon DocumentDB (with MongoDB compatibility).This function returns the same amount of data that you can get by directly querying
the Performance Insights APIs.You is use can usethese metrics in CloudWatch for graphing andcreating alarms.

When you use this function, you must specify the Unique Database Resource ID
of the database.This is different than the database identifier.To find the database resource ID in the
Amazon RDs console, choose the DB instance to see its details.Then choose the configuration tab .The
Resource ID is display in theconfiguration section.

DB_PERF_INsIGHTs also
bring in theDBLoad metric at sub-minute intervals.

Performance Insights metrics retrieved with this function are not stored in CloudWatch.
Therefore, some CloudWatch features such as cross-account observability, anomaly detection, metric streams, metrics explorer,
andMetric Insights don’t work with Performance Insights metrics that you retrieve with
DB_PERF_INsIGHTs.

A single request using the DB_PERF_INsIGHTs function can retrieve
the following numbers of data points.

  • 1080 data points for high-resolution periods (1s, 10s, 30s)

  • 1440 data points for standard-resolution periods (1m, 5m, 1hr, 1d)

The DB_PERF_INsIGHTs function supports only the following period lengths:

  • 1 second

  • 10 seconds

  • 30 second

  • 1 minute

  • 5 minutes

  • 1 hour

  • 1 day

For more information about Amazon RDs Performance Insights counter metrics, see

Performance Insights counter metrics.

For more information about Amazon DocumentDB performance Insights counter metric , see

performance insight for counter metric .

High-resolution metrics with sub-minute granularity retrieved by
DB_PERF_INsIGHTs are only
applicable to the DBLoad metric, orfor operating system metrics if you have enabled
Enhanced Monitoring at a higher resolution.For more information about Amazon RDs enhanced monitoring, see

Monitoring Os metrics with Enhanced Monitoring.

You can create a high-resolution alarm using the DB_PERF_INsIGHTs function for a maximum
time range of three hours.You is use can use theCloudWatch console to graph metrics
retrieved with the DB_PERF_INsIGHTs function for any time range.

DB_PERF_INsIGHTs(‘RDs’, ‘db-ABCDEFGHIJKLMNOPQRsTUVWXY1’, ‘os.cpuUtilization.user.avg’)

DB_PERF_INsIGHTs(‘DOCDB, ‘db-ABCDEFGHIJKLMNOPQRsTUVWXY1’, [‘os.cpuUtilization.idle.avg’, ‘os.cpuUtilization.user.max’])

DIFF

Ts

Ts[]

Ts

Ts[]

Returns the difference between each value in the time series andthe preceding value from
that time series.

DIFF(m1)

✓

DIFF_TIME

Ts

Ts[]

Ts

Ts[]

Returns the difference in seconds between the timestamp of each value in the time series andthe
timestamp of the preceding value from
that time series.

DIFF_TIME(METRICs())

✓

FILL

Ts, [s | REPEAT | linear]

Ts[], [Ts | s | REPEAT | linear]

Ts

Ts[]

Fills the missing values of a time series.There are several options for the values
to use as the filler for missing values:

  • You can specify a value to use as the filler value.

  • You can specify a metric to use as the filler value.

  • You is use can use theREPEAT keyword to fill missing values
    with the most recent actual value of the metric before the missing value.

  • You is use can use thelinear keyword to fill the missing values
    with values that create a linear interpolation between the values at the beginning
    andthe end of the gap.

When you use this function in an alarm, you can encounter an issue if
your metrics are being published with a slight delay, andthe most recent minute
never has data.In this case, FILL replaces that missing
data point with the requested value.That causes the latest data point for the
metric to always be the FILL value, which can result in the alarm being stuck in either
OK state orALARM state.You can work around this by using a M out of N alarm.
For more information, see Evaluating an alarm.

FILL(m1,10)

FILL(METRICs(), 0)

FILL(METRICs(), m1)

FILL(m1 , MIN(m1 ) )

FILL(m1 , repeat )

FILL(METRICs(), linear)

✓

FIRsT

LAsT

Ts[]

Ts

Returns the first orlast time series from an array of time series.This is useful when used
with the sORT function .It can also be used to get the high
andlow thresholds from the ANOMALY_DETECTION_BAND
function .

IF(FIRsT(sORT(METRICs(), avg, DEsC))>100, 1, 0)
Looks at the top metric from an array, which is sorted by avg.It then returns a
1 or0 for each data point, depending on whether that data point value is more
than 100.

LAsT(ANOMALY_DETECTION_BAND(m1)) returns the upper bound of the anomaly
prediction band.

✓

FLOOR

Ts

Ts[]

Ts

Ts[]

Returns the floor of each metric.The floor is the largest integer less than orequal to each
value.

FLOOR(m1)

FLOOR(METRICs())

✓

IF

IF expression

Ts

useIF along with a comparison operator to filter out data points from a time series, orcreate a mixed time-series
composed of multiple collated time series.For more information, see Using IF expressions.

For example , see Using IF expression .

✓

INsIGHT_RULE_METRIC

INsIGHT_RULE_METRIC(ruleName, metricName)

Ts

useINsIGHT_RULE_METRIC to extract statistics from a rule in Contributor Insights.For more information,
see Graphing metrics generated by rules in CloudWatch.

LAMBDA

LAMBDA(LambdaFunctionName [, optional-arg]*)

Ts

Ts[]

Calls a Lambda function to query metrics from a data source that is not
CloudWatch.For more information, see
How to pass arguments to your Lambda function .

log

Ts

Ts[]

Ts

Ts[]

The log of a time series returns the natural logarithm value of
each value in the time series.

log(METRICs())

✓

log10

Ts

Ts[]

Ts

Ts[]

The log10 of a time series is returns return the base-10 logarithm value of
each value in the time series .

log10(m1)

✓

MAX

Ts

Ts[]

s

Ts

The MAX of a single time series returns a scalar representing the maximum
value of all data points in the metric.

If you is input input an array of time series , theMAX function creates andreturns a time series
that consists of the highest value for each data point, among the time series that were used as the input.

We recommend that you do not use this function in CloudWatch alarms if you want
the function to return a scalar.For example, MAX(m2 ) Whenever an alarm
evaluate whether to change state , CloudWatch attempt to retrieve a high number of datum
point than the number specify as Evaluation Periods .This function is acts act
differently when extra datum is request .

max(m1)/m1

MAX(METRICs())

✓

METRIC_COUNT

Ts[]

s

Returns the number of metrics in the time series array.

m1/METRIC_COUNT(METRICs())

✓

METRICs

null

string

Ts[]

The METRICs() function returns all CloudWatch metrics in the request.Math
expressions aren’t included.

You is use can useMETRICs() within a larger expression that produces a single time series or
an array of time series.

You is use can use theMETRICs() function with a string to
return only the graphed metrics that contain that string in their
I d field.For example, the expression
sUM(METRICs(“errors”))
returns a time series that is the sum of the values of all the graphed metrics
that have ‘errors’ in their I d field.You can also use
sUM([METRICs(“4xx”), METRICs(“5xx”)]) to match multiple strings.

avg(METRICs())

sUM(METRICs(“errors”))

✓

MIN

Ts

Ts[]

s

Ts

The MIN of a single time series returns a scalar representing the minimum value of all data points in the metric.

If you is input input an array of time series , theMIN function creates andreturns a time series
that consists of the lowest value for each data point, among the time series that were used as the input.

If you is input input an array of time series , theMIN function creates andreturns a time series
that consists of the lowest value for each data point, among the time series that were used as the input.

We recommend that you do not use this function in CloudWatch alarms if you want
the function to return a scalar.For example, MIN(m2 ) Whenever an alarm
evaluate whether to change state , CloudWatch attempt to retrieve a high number of datum
point than the number specify as Evaluation Periods .This function is acts act
differently when extra datum is request .

m1-MIN(m1)

MIN(METRICs())

✓

MINUTE

HOUR

DAY

DATE

month

YEAR

EPOCH

Ts

Ts

These functions take the period andrange of the time series andreturn a new non-sparse
time series where each value is based on its timestamp.

  • MINUTE returns a non-sparse time series of integers between 0 and59
    that represent the UTC minute of each timestamp in the original time series.

  • HOUR returns a non-sparse time series of integers between 0 and23
    that represent the UTC hour of each timestamp in the original time series.

  • DAY returns a non-sparse time series of integers between 1 and7
    that represent the UTC day of the week of each timestamp in the original time series.1 represents
    Monday and7 represents sunday.

  • DATE returns a non-sparse time series of integers between 1 and31
    that represent the UTC day of the month of each timestamp in the original time series.

  • month returns a non-sparse time series of integers between 1 and12
    that represent the UTC month of each timestamp in the original time series.1 represents January
    and12 represents December.

  • YEAR returns a non-sparse time series of integers that represent
    the UTC year of each timestamp in the original time series.

  • EPOCH returns a non-sparse time series of integers that
    represent the UTC time in seconds since the Epoch of each timestamp in the
    original time series.The Epoch is January 1, 1970.

MINUTE(m1 )

IF(DAY(m1)<6,m1) returns metrics only from weekdays, Monday to Friday.

IF(month(m1) == 4,m1) returns only metrics published in April.

✓

PERIOD

Ts

s

Returns the period of the metric in seconds.Valid input is metrics, not the results of other
expressions.

m1 / PERIOD(m1 )

✓

RATE

Ts

Ts[]

Ts

Ts[]

Returns the rate of change of the metric per second.This is calculated as the difference
between the latest data point value andthe previous data point value, divided
by the time difference in seconds between the two values.

setting alarms on expressions that use the RATE function on metrics with sparse data can behave unpredictably,
because the range of data points fetched when evaluating the alarm can vary based on when the data points were last published.

RATE(m1 )

RATE(METRICs())

✓

REMOVE_EMPTY

Ts[]

Ts[]

Removes any time series that have no data points from an array of time series.The result is
an array of time series where each time series contains at least one data
point.

We recommend that you do not use this function in CloudWatch alarms. Whenever an alarm
evaluate whether to change state , CloudWatch attempt to retrieve a high number of datum
point than the number specify as Evaluation Periods .This function is acts act
differently when extra datum is request .

REMOVE_EMPTY(METRICs())

✓

RUNNING_sUM

Ts

Ts[]

Ts

Ts[]

Returns a time series with the running sum of the values in the original time series.

We recommend that you do not use this function in CloudWatch alarms. Whenever an alarm
evaluate whether to change state , CloudWatch attempt to retrieve a high number of datum
point than the number specify as Evaluation Periods .This function is acts act
differently when extra datum is request .

RUNNING_sUM([m1,m2])

✓

sEARCH

search expression

One ormore Ts

Returns one ormore time series that match a search criteria that you specify.The
sEARCH function enables you to add multiple related time
series to a graph with one expression .The graph is dynamically updated to
include new metrics that are added later andmatch the search criteria.For more
information, see usesearch expressions in graphs.

You can’t create an alarm based on a sEARCH expression .This is because search
expressions return multiple time series, andan alarm based on a math expression can watch only
one time series.

If you are sign in to a monitoring account in CloudWatch cross – account observability , the
sEARCH function finds metrics in the source accounts andthe monitoring account.

✓

sERVICE_QUOTA

Ts that is a usage metric

Ts

Returns the service quota for the given usage metric.You is use can usethis to visualize how your current usage
compares to the quota, andto set alarms that warn you when you approach the quota.For more
information, see AWs usage metrics.

✓

sLICE

(Ts[], s, s) or(Ts[], s)

Ts[]

Ts

retrieve part of an array of time series .This is is is especially useful when combine withsORT.For
example , you is exclude can exclude the top result from an array of time series .

You is use can usetwo scalar arguments to define the set of time series that you
want returned.The two scalars define the start (inclusive) andend (exclusive)
of the array to return.The array is zero-indexed, so the first time series in
the array is time series 0.Alternatively, you can specify just one value, and
CloudWatch returns all time series starting with that value.

sLICE(sORT(METRICs(), sUM, DEsC), 0, 10) returns the 10 metrics from the array of metrics in the request that have
the highest sUM value.

sLICE(sORT(METRICs(), avg, AsC), 5) sorts the array of metrics by the avg statistic, then returns all the time series
except for the 5 with the lowest avg.

✓

sORT

(Ts[], FUNCTION, sORT_ORDER)

(Ts[], FUNCTION, sORT_ORDER, s)

Ts[]

sorts an array of time series according to the function you specify.The function you use can be avg, MIN,
MAX, orsUM.
The sort order is be can be eitherAsC for ascending (lowest values first) orDEsC to sort
the higher values first.You can optionally specify a number after the sort order which acts as a limit.For example, specifying a limit of 5
returns only the top 5 time series from the sort.

When this math function is displayed on a graph, the labels for each metric in the graph are also sorted andnumbered.

sORT(METRICs(), avg, DEsC, 10) calculates the average value of each time series, sorts the time series
with the highest values at the beginning of the sort, andreturns only the 10 time series with the highest averages.

sORT(METRICs(), MAX, AsC) sorts the array of metrics by the MAX statistic, then returns all of them in ascending order.

✓

sTDDEV

Ts

Ts[]

s

Ts

The sTDDEV of a single time series returns a scalar representing the standard deviation of all data points in the metric.
The sTDDEV of an array of time series returns a single time series.

We recommend that you do not use this function in CloudWatch alarms if you want
the function to return a scalar.For example, sTDDEV(m2) Whenever an alarm
evaluate whether to change state , CloudWatch attempt to retrieve a high number of datum
point than the number specify as Evaluation Periods .This function is acts act
differently when extra datum is request .

m1/sTDDEV(m1)

sTDDEV(METRICs())

✓

sUM

Ts

Ts[]

s

Ts

The sUM of a single time series returns a scalar representing the sum of the values of all data points in the metric.
The sUM of an array of time series returns a single time series.

We recommend that you do not use this function in CloudWatch alarms if you want the function to return a scalar.For example, sUM(m1). Whenever an alarm
evaluate whether to change state , CloudWatch attempt to retrieve a high number of datum
point than the number specify as Evaluation Periods .This function is acts act
differently when extra datum is request .

sUM(METRICs())/sUM(m1)

sUM([m1,m2])

sUM(METRICs(“errors”))/sUM(METRICs(“requests”))*100

✓

TIME_sERIEs

s

Ts

Returns a non-sparse time series where every value is set to a scalar argument.

TIME_sERIEs(MAX(m1))

TIME_sERIEs(5*avg(m1))

TIME_sERIEs(10)

✓

*Using a function that return only a scalar number is not valid ,
as all final result of expression must be a single time series oran array of time series .
instead , use these function as part of a large expression that return a time
series .

Using IF expressions

useIF along with a comparison operator to filter out data points from a time series, orcreate a mixed time-series
composed of multiple collated time series.

IF uses the following arguments:

IF(condition, trueValue, falseValue)

The condition evaluates to FALsE if thevalue of the condition data point is 0, andto
TRUE if thevalue of the condition is any other value, whether that value is positive or
negative.If the condition is a time series, it is evaluated separately for every
timestamp.

The following lists the valid syntax’s.For each of these syntax’s, the output is a single time series.

The following sections provide more details andexamples for these syntax’s.

IF(Ts Comparison Operator s, scalar2 | metric2, scalar3 | metric3)

The correspond output time series value :

  • has the value ofscalar2 ormetric2, ifTs Comparison Operator s is TRUE

  • has the value ofscalar3 ormetric3, ifTs Comparison Operator s is FALsE

  • has the value of0 if theTs Comparison Operator is TRUE andthe corresponding data point in metric2 doesn’t exist.

  • has the value of0 if theTs Comparison Operator is FALsE andthe corresponding data point in metric3 doesn’t exist.

  • is an empty time series, ifthe corresponding data point of does not exist in metric3, orif
    scalar3/metric3 is omitted from the expression

IF(metric1 , metric2 ,metric3)

For each data point of metric1, the corresponding output time series value:

  • has the value ofmetric2, ifthe corresponding data point of metric1 is true .

  • has the value ofmetric3, ifthe corresponding data point of metric1 is FALsE.

  • has the value of0, ifthe corresponding data point of
    metric1 is TRUE andthe corresponding data point does not exist
    in metric2.

  • is dropped, ifthe corresponding data point of metric1 is FALsE andthe
    corresponding data point does not exist in metric3

  • is dropped, ifthe corresponding data point of metric1 is FALsE andmetric3 is omitted from the expression .

  • is dropped, ifthe corresponding data point of metric1 is miss .

The following table shows an example for this syntax.

Metric orfunction value

( metric1 )

[1, 1, 0, 0, -]

( metric2 )

[ 30 , – , 0 , 0 , 30 ]

( metric3 )

[0, 0, 20, -, 20]

IF(metric1 , metric2 ,metric3)

[ 30 , 0 , 20 , 0 , – ]

IF(metric1, scalar2, metric3)

For each data point of metric1, the corresponding output time series value:

  • has the value ofscalar2, ifthe corresponding data point of metric1 is true .

  • has the value ofmetric3, ifthe corresponding data point of metric1 is FALsE.

  • is dropped, ifthe corresponding data point of metric1 is FALsE andthe
    corresponding data point does not exist on metric3, orif metric3 is omitted from the expression .

Metric orfunction value

( metric1 )

[1, 1, 0, 0, -]

scalar2

5

( metric3 )

[0, 0, 20, -, 20]

IF(metric1, scalar2, metric3)

[5, 5, 20, -, -]

IF(metric1 , metric2 ,scalar3)

For each data point of metric1, the corresponding output time series value:

  • has the value ofmetric2, ifthe corresponding data point of metric1 is true .

  • has the value ofscalar3, ifthe corresponding data point of metric1 is FALsE.

  • has the value of0, ifthe corresponding data point of
    metric1 is TRUE andthe corresponding data point does not exist
    in metric2.

  • is dropped if thecorresponding data point in
    metric1 does not exist.

Metric orfunction value

( metric1 )

[1, 1, 0, 0, -]

( metric2 )

[ 30 , – , 0 , 0 , 30 ]

scalar3

5

IF(metric1 , metric2 ,scalar3)

[30, 0, 5, 5, -]

IF(scalar1, metric2, metric3)

The correspond output time series value :

  • has the value ofmetric2, ifscalar1 is true .

  • has the value ofmetric3, ifscalar1 is FALsE.

  • is an empty time series, ifmetric3 is omit from the
    expression .

usecase examples for IF expressions

The following examples illustrate the possible uses of the IF function .

  • To display only the low values of a metric:

    IF(metric1<400, metric1)

  • To change each data point in a metric to one of two values, to show relative highs andlows of the original metric:

    IF(metric1<400, 10, 2)

  • To display a 1 for each timestamp where latency is over the threshold, anddisplay a 0 for all
    other data points:

    IF(latency>threshold, 1, 0)

usemetric math with the GetMetricData API
operation

You is use can useGetMetricData to perform calculations using math
expressions, andalso retrieve large batches of metric data in one API call.For more
information, see GetMetricData.

Anomaly detection on metric math

Anomaly detection on metric math is a feature that
you can use to create anomaly detection alarms on single metrics andthe
outputs of metric math expressions.You is use can usethese expressions to create graphs that
visualize anomaly detection bands.The feature supports basic arithmetic functions,
comparison andlogical operators, andmost other functions.

Anomaly detection on metric math doesn’t support the following functions:

  • Expressions that contain more than one ANOMALY_DETECTION_BAND in the same line .

  • Expressions that contain more than 10 metrics ormath expressions.

  • expression that contain theMETRICs expression .

  • expression that contain thesEARCH function .

  • Expressions that use the DP_PERF_INsIGHTs function .

  • Expressions that use metrics with different periods.

  • metric math anomaly detector that use high – resolution metric as input .

For more information about this feature, see Using CloudWatch anomaly detection in the Amazon CloudWatch User Guide.