Simplify AWS CloudTrail log evaluation with pure language question technology in CloudTrail Lake (preview)

At present, I’m pleased to announce in preview the generative synthetic intelligence (generative AI)–powered pure language question technology in AWS CloudTrail Lake, which is a managed information lake for capturing, storing, accessing, and analyzing AWS CloudTrail exercise logs to fulfill compliance, safety, and operational wants. You may ask a query utilizing pure language about these exercise logs (administration and information occasions) saved in CloudTrail Lake with out having the technical experience to write down a SQL question or spend time to decode the precise construction of exercise occasions. For instance, you would possibly ask, “Inform me what number of database cases are deleted and not using a snapshot”, and the characteristic will convert that query to a CloudTrail Lake question, which you’ll run as-is or modify to get the requested occasion data. Pure language question technology makes the method of exploration of AWS exercise logs less complicated.

Now, let me present you how you can begin utilizing pure language question technology.

Getting began with pure language question technology
The pure language question generator makes use of generative AI to supply a ready-to-use SQL question out of your immediate, which you’ll then select to run within the question editor of CloudTrail Lake.

Within the AWS CloudTrail console, I select Question below Lake. The question generator can solely generate queries for occasion information shops that accumulate CloudTrail administration and information occasions. I select an occasion information retailer for my CloudTrail Lake question from the dropdown record in Occasion information retailer. Within the Question generator, I enter the next immediate within the Immediate subject utilizing pure language:

What number of errors have been logged through the previous month?

Then, I select Generate question. The next SQL question is robotically generated:

SELECT COUNT(*) AS error_count
FROM 8a6***
WHERE eventtime >= '2024-04-21 00:00:00'
    AND eventtime <= '2024-05-21 23:59:59'
    AND (
        errorcode IS NOT NULL
        OR errormessage IS NOT NULL
    )

I select Run to see the outcomes.

That is attention-grabbing, however I wish to know extra particulars. I wish to see which providers had probably the most errors and why these actions have been erroring out. So I enter the next immediate to request further particulars:

What number of errors have been logged through the previous month for every service and what was the reason for every error?

I select Generate question, and the next SQL question is generated:

SELECT eventsource,
    errorcode,
    errormessage,
    COUNT(*) AS errorCount
FROM 8a6***
WHERE eventtime >= '2024-04-21 00:00:00'
    AND eventtime <= '2024-05-21 23:59:59'
    AND (
        errorcode IS NOT NULL
        OR errormessage IS NOT NULL
    )
GROUP BY 1,
    2,
    3
ORDER BY 4 DESC;

I select Run to see the outcomes.

Within the outcomes, I see that my account experiences most variety of errors associated to Amazon S3, and prime errors are associated to CORS and object degree configuration. I can proceed to dig deeper to see extra particulars by asking additional questions. However now let me give pure language question generator one other instruction. I enter the next immediate within the Immediate subject:

What are the highest 10 AWS providers that I used up to now month? Embody occasion title as properly.

I select Generate question, and the next SQL question is generated. This SQL assertion retrieves the sphere names (eventSource,
eventName, COUNT(*) AS event_count), restricts the rows with the date interval of the previous month within the WHERE clause, teams the rows by eventSource and eventName, kinds them by the utilization rely, and restrict the consequence to 10 rows as I requested in a pure language.

SELECT eventSource,
    eventName,
    COUNT(*) AS event_count
FROM 8a6***
WHERE eventTime >= timestamp '2024-04-21 00:00:00'
    AND eventTime <= timestamp '2024-05-21 23:59:59'
GROUP BY 1,
    2
ORDER BY 3 DESC
LIMIT 10;

Once more, I select Run to see the outcomes.

I now have a greater understanding of what number of errors have been logged through the previous month, what service the error was for, and what prompted the error. You may strive asking questions in plain language and run the generated queries over your logs to see how this characteristic works together with your information.

Be a part of the preview
Pure language question technology is on the market in preview within the US East (N. Virginia) Area as a part of CloudTrail Lake.

You need to use pure language question technology in preview for no further value. CloudTrail Lake question expenses apply when operating the question to generate outcomes. For extra data, go to AWS CloudTrail Pricing.

To be taught extra and get began utilizing pure language question technology, go to AWS CloudTrail Lake Person Information.

— Esra