CloudWatch Metric filters with default value not making sense

Question

I've created a metric filter just to get an idea about how many times a specific log pattern shows up, nothing crazy. `Metric value` is set to 1 and `Default value` is set to 0. Since it's not a high-resolution metric, CloudWatch is aggregating it in a minute period. All good with that.
What I do not understand is the difference between the `Sum` and `Sample Count` statistics. Why `Sum` and `Sample Count` would have different values? 
* If we assume that there was no record in the 1-minute interval with the filter pattern, `Sum` would be 0, and `Sample Count` would be 0.
* If we assume that there was at least one record in the 1-minute interval with the filter pattern, `Sum` would be X, and `Sample Count` would be X, where X is greater than 0.

An example:
Let's say I created a metric filter with the pattern "ERROR:", and I set `Metric value` is set to 1 and `Default value` is set to 0.
We have the following logs for three different log streams under the same log group in a specific minute in the timeline:

Log stream 1:
- ERROR: XXXXXXX
- INFO: XXXXXX

Log stream 2:
- INFO: XXXXXX
- INFO: XXXXXX

Log stream 3:
- ERROR: XXXXXXX
- ERROR: XXXXXXX
- ERROR: XXXXXXX

What would be the values for `Sum` and `Sample Count` in your opinion? 4, right!?

Answer

Hi, according to the definition in the CloudWatch documentation below, they are actually representing a different view of the metric.

* **SampleCount** is the number of data points during the period.
* **Sum** is the sum of the values of the all data points collected during the period.

https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Statistics-definitions.html

From your example, **Sum** would be 4 but **SampleCount** would be 7 since it's counting the number of data points. Please note that the log message that doesn't match with the filter pattern will also generate a data point with value "0" (Based on the Default Value setting) to the corresponding metric. Therefore, in your example, there are 7 data points, 4 with value "1" and 3 with value "0". The **Sum** is calculated by 1+1+1+1+0+0+0 = 4.

Hope my explanation helps!

CloudWatch Metric filters with default value not making sense

Contenido relevante