Newbe Dev Stack

Answer : I think you need to select them as fields and then filter on their value. e.g: fields @timestamp, @message, strcontains(@message, "user not found") AS unf | filter unf=1 | sort @timestamp desc | limit 20 Or use regex fields @timestamp, @message | filter @message like /User\snot\sfound/ | ... (haven't tested them) This should work fine fields @timestamp, @message | filter @message like /user not found/ | sort @timestamp desc | limit 20

Answer : Yes you can do this. You have to use a step scaling policy, and you need to have an alarm created already for your SQS queue depth (ApproximateNumberOfMessagesVisible). Go to CloudWatch, create a new alarm. We'll call this alarm sqs-queue-depth-high , and have it trigger when the approximate number of messages visible is 1000. With that done, go to ECS to the service you want to autoscale. Click Update for the service. Add a scaling policy and choose the Step Tracking variety. You'll see there's an option to create a new alarm (which only lets you choose between CPU or MemoryUtilization), or use an existing alarm. Type sqs-queue-depth-high in the "Use existing alarm" field and press enter, you should see a green checkmark that lets you know the name is valid (i.e. the alarm exists). You'll see new dropdowns where you can adjust the step policy now. This works for any metric alarm and ECS services. If you're going to be trying to scale this...