RDS Pack
20 minute read
Edge Delta Pipeline Pack for AWS Relational Database Service (RDS)
Overview
The Edge Delta RDS pack processes CloudWatch metrics from AWS Relational Database Service instances. It handles two distinct data types: standard CloudWatch metric streams containing individual metrics like CPU utilization and IOPS, and enhanced monitoring logs that bundle detailed OS-level metrics from the Lambda forwarder. All incoming logs pass through both processing paths in parallel, with conditional logic determining which multiprocessor successfully transforms each log type. Extracted metrics and transformed logs are then routed to downstream processors for analysis and storage.
Sample inputs from the pipeline include standard metric streams (samples.json lines 3-9, 15-20, 29-127 showing metrics like CPUUtilization, FreeableMemory, WriteIOPS), enhanced error and slowquery logs (samples.json lines 11-13, 123-124 from Lambda forwarder with logEvents arrays), and RDSOS enhanced monitoring metrics (samples.json line 27 with detailed OS-level CPU, memory, and process data).
Pack Description
1. Data Ingestion
RDS metrics can be ingested through two methods:
Standard RDS Metric Ingestion
Standard CloudWatch metrics are sent via CloudWatch metric streams. After enabling CloudWatch metric streams for RDS, configure either:
- An Edge Delta S3/SQS input to pick up metrics forwarded to S3 via CloudWatch streams
- An Edge Delta Lambda forwarder to send CloudWatch data via HTTP input
See AWS documentation for RDS monitoring: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Monitoring.html
For S3 input configuration: https://docs.edgedelta.com/s3_input_node/
For more details: https://edgedelta.com/company/blog/how-to-monitor-aws-relational-database-service-with-edge-delta
Enhanced RDS Monitoring Ingestion
Enhanced monitoring provides OS-level metrics bundled together in a single log entry. Enable enhanced monitoring for RDS instances as described here: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.html
Configure the Edge Delta Lambda forwarder to send these logs: https://docs.edgedelta.com/aws-lambda-forwarder/
2. Pack Entry Point
The data flow starts with the Pack Source (compound_input_9562) compound_input node as the entry point into the pack. All logs—whether standard metric streams or enhanced monitoring logs—enter here and begin their processing journey. Compound_input nodes simply collect data and fan it out to downstream processors without transforming the data themselves.
From Pack Source, every incoming log is sent to both multiprocessors in parallel:
- Path 1: All logs flow to
RDS Standard Metrics Multi Processor(sequence_b363) - Path 2: All logs flow to
RDS Enhanced Metrics(sequence_a70a)
This parallel fan-out architecture (defined in content.yaml links section, lines 661-664) means that conditional logic within each multiprocessor—not upfront routing—determines which logs are successfully transformed. Standard metrics pass through the Enhanced Metrics multiprocessor unchanged (and likely fail silently or pass through), while enhanced logs from the Lambda forwarder pass through the Standard Metrics multiprocessor without matching any conditional groups. This design allows the pack to handle both data types without complex pre-routing logic.
3. Processing Standard CloudWatch Metrics
3.1. RDS Standard Metrics Multi Processor
All logs flow to the RDS Standard Metrics Multi Processor (sequence_b363) node, a Multiprocessor node. This multiprocessor contains a series of processors that parse JSON and extract metrics based on the metric name. Logs that don’t contain a metric_name field or don’t match any of the 21 conditional groups simply pass through this multiprocessor unchanged and continue to the Pack Destination.
- name: sequence_b363
type: sequence
user_description: RDS Standard Metrics Multi Processor
The multiprocessor performs two stages:
Stage 1: Parse JSON
The first processor is an OTTL Transform that parses the incoming JSON body and merges it into the log attributes.
- type: ottl_transform
metadata: '{"id":"QgfeIwOWS3N8gP_G1wqLG","type":"parse-json","name":"Parse JSON","isRecommendation":true}'
data_types:
- log
statements: |-
set(cache["parsed-json"], ParseJSON(body))
merge_maps(attributes, cache["parsed-json"], "upsert") where IsMap(attributes) and IsMap(cache["parsed-json"])
set(attributes, cache["parsed-json"]) where not (IsMap(attributes) and IsMap(cache["parsed-json"]))
This transformation decodes the JSON structure from the message body, making fields like metric_name, value, account_id, region, and dimensions accessible as attributes. By exposing these fields, you can route and extract metrics based on the specific metric type. If the JSON parsing fails (for example, if an enhanced monitoring log enters this processor), the log continues unchanged.
Stage 2: Conditional Metric Extraction
After parsing, the multiprocessor contains 21 conditional groups, each targeting a specific RDS metric. Each conditional group uses a sequence processor with a condition that checks the metric_name attribute. If the condition matches, an Extract Metric Processor extracts gauge metrics from the value object. If none of the 21 conditions match, the log simply passes through without modification.
Below are the 21 conditional groups included in this multiprocessor:
3.1.1. CPU Utilization Metrics
- type: sequence
metadata: '{"id":"JmC7c1kBy2g_co-IGjKM4","type":"sequence","name":"CPU Util Conditional Group"}'
condition: attributes["metric_name"] == "CPUUtilization"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"zfuE_eN6PzL0mIeeKgeML","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_cpuutil_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_cpuutil_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_cpuutil_min
unit: "1"
gauge:
value: attributes["value"]["min"]
- name: rds_cpuutil_count
unit: "1"
gauge:
value: attributes["value"]["count"]
This conditional group matches logs where metric_name is CPUUtilization. It extracts four gauge metrics: sum, max, min, and count. These metrics let you track CPU usage patterns over time, identify peak usage periods, and detect anomalies in database performance.
3.1.2. Read IOPS Metrics
- type: sequence
metadata: '{"id":"oH_oThRhmePfv3t1of6X_","type":"sequence","name":"ReadIOPS Conditional Group"}'
condition: attributes["metric_name"] == "ReadIOPS"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"-acb91pQAFSqj0LPIWt80","type":"extract_metric","name":"ReadIOPS Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_readiops_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_readiops_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_readiops_min
unit: "1"
gauge:
value: attributes["value"]["min"]
- name: rds_readiops_count
unit: "1"
gauge:
value: attributes["value"]["count"]
This group matches ReadIOPS metrics and extracts sum, max, min, and count gauges. Monitoring read IOPS helps you understand database read performance and capacity planning, especially when diagnosing slow query performance or evaluating whether to scale storage.
3.1.3. Write IOPS Metrics
- type: sequence
metadata: '{"id":"sc_x-WhpvrUtnFCZq5u1D","type":"sequence","name":"WriteIOPS Conditional Group"}'
condition: attributes["metric_name"] == "WriteIOPS"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"m3bjqQW62IyoNs5ekNGjb","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_writeiops_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_writeiops_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_writeiops_min
unit: "1"
gauge:
value: attributes["value"]["min"]
- name: rds_writeiops_count
unit: "1"
gauge:
value: attributes["value"]["count"]
This group extracts write IOPS metrics, providing visibility into database write operations. High write IOPS can indicate heavy transaction loads or batch processing, helping you optimize write performance and storage throughput.
3.1.4. Freeable Memory Metrics
- type: sequence
metadata: '{"id":"fEZqma7fBH80taeIqT84a","type":"sequence","name":"FreeableMemory Conditional Group"}'
condition: attributes["metric_name"] == "FreeableMemory"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"i6EBfnMnsU8-Gcw-JkTPL","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_freablememory_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_freablememory_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_freablememory_min
unit: "1"
gauge:
value: attributes["value"]["min"]
- name: rds_freablememory_count
unit: "1"
gauge:
value: attributes["value"]["count"]
This group tracks available memory on the RDS instance. Low freeable memory can cause performance degradation and swap usage, making this metric critical for capacity planning and identifying memory leaks.
3.1.5. Read Latency Metrics
- type: sequence
metadata: '{"id":"RJLZoGiDSaZylApEjMMW_","type":"sequence","name":"Read Latency Conditional Group"}'
condition: attributes["metric_name"] == "ReadLatency"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"uJoUiPaxf70sd4xm6R8T-","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_readlatency_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_readlatency_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_readlatency_min
unit: "1"
gauge:
value: attributes["value"]["min"]
- name: rds_readlatency_count
unit: "1"
gauge:
value: attributes["value"]["count"]
This group extracts read latency metrics, measuring the time taken for read operations. Elevated read latency indicates storage bottlenecks or inefficient queries, helping you diagnose performance issues affecting application response times.
3.1.6. Write Latency Metrics
- type: sequence
metadata: '{"id":"moZ0bQsXlSB_DrvT2TW3Y","type":"sequence","name":"Write Latency Conditional Group"}'
condition: attributes["metric_name"] == "WriteLatency"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"yDP91JrH3BEDEy9rqtXJW","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_writelatency_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_writelatency_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_writelatency_min
unit: "1"
gauge:
value: attributes["value"]["min"]
- name: rds_writelatency_count
unit: "1"
gauge:
value: attributes["value"]["count"]
This group captures write latency metrics, showing the duration of write operations. High write latency can indicate I/O contention or storage provisioning issues, essential for maintaining database write performance.
3.1.7. Database Connections Metrics
- type: sequence
metadata: '{"id":"tMTZiZXjfdR_RSYyxhqLP","type":"sequence","name":"DB Connections Conditional Group"}'
condition: attributes["metric_name"] == "DatabaseConnections"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"-V_LndcImbNgVrH4ZAo7_","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_dbconnections_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_dbconnections_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_dbconnections_min
unit: "1"
gauge:
value: attributes["value"]["min"]
- name: rds_dbconnections_count
unit: "1"
gauge:
value: attributes["value"]["count"]
This group monitors the number of active database connections. Tracking connection counts helps you detect connection pool exhaustion, connection leaks, and optimize connection management in your applications.
3.1.8. Network Transmit Throughput Metrics
- type: sequence
metadata: '{"id":"2CiQMwR4CX6mjwJIAxl6g","type":"sequence","name":"NetworkTX Conditional Group"}'
condition: attributes["metric_name"] == "NetworkTransmitThroughput"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"4Urrr4AinDh8CHBqsFtwS","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_networktx_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_networktx_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_networktx_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group extracts network transmit throughput, measuring outbound network traffic from the RDS instance. Monitoring network egress helps you understand data replication patterns and application query result sizes.
3.1.9. Network Receive Throughput Metrics
- type: sequence
metadata: '{"id":"QRh-st6oSZCwp1PPPDYHp","type":"sequence","name":"NetworkRX Conditional Group"}'
condition: attributes["metric_name"] == "NetworkReceiveThroughput"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"R5Hyl6xCBc1lHQ6gPl_sT","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_networkrx_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_networkrx_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_networkrx_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group captures network receive throughput, tracking inbound network traffic. High ingress traffic can indicate large data imports or heavy query loads from applications.
3.1.10. Read Throughput Metrics
- type: sequence
metadata: '{"id":"jvx5T6SEIbYTs5PRgTJ3v","type":"sequence","name":"Read Throughput Conditional Group"}'
condition: attributes["metric_name"] == "ReadThroughput"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"8lRNV39qocOAb9-q8shMx","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_readthroughput_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_readthroughput_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_readthroughput_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group extracts disk read throughput metrics, measuring the volume of data read from storage. Monitoring read throughput helps you evaluate storage performance and identify I/O-intensive queries.
3.1.11. Write Throughput Metrics
- type: sequence
metadata: '{"id":"aVPtubwniMdN_eDaieMG_","type":"sequence","name":"Write Throughput Conditional Group"}'
condition: attributes["metric_name"] == "WriteThroughput"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"AX_bWudiIdyVqV21Y88Gd","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_writethroughput_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_writethroughput_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_writethroughput_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group captures disk write throughput, showing the volume of data written to storage. Write throughput monitoring helps you understand transaction loads and optimize batch write operations.
3.1.12. Disk Queue Depth Metrics
- type: sequence
metadata: '{"id":"wWkajVwR_0kGuzR7ItCY5","type":"sequence","name":"Disk Q Depth Conditional Group"}'
condition: attributes["metric_name"] == "DiskQueueDepth"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"C4bOwCMTM0wrYdkzF4vsn","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_diskqdepth_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_diskqdepth_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_diskqdepth_min
unit: "1"
gauge:
value: attributes["value"]["min"]
- name: rds_diskqdepth_count
unit: "1"
gauge:
value: attributes["value"]["count"]
This group extracts disk queue depth metrics, indicating the number of outstanding I/O requests. High queue depth suggests I/O saturation and helps you identify when storage is becoming a bottleneck.
3.1.13. Burst Balance Metrics
- type: sequence
metadata: '{"id":"DVjGRSsUWDlpOq9P_XQ0l","type":"sequence","name":"Burst Balance Conditional Group"}'
condition: attributes["metric_name"] == "BurstBalance"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"RTztRwPj7BXrCPqhfyLfU","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_burstbalance_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_burstbalance_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_burstbalance_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group monitors burst balance for gp2 and gp3 storage volumes. Depleted burst balance leads to throttled IOPS, making this metric critical for maintaining consistent storage performance.
3.1.14. CPU Credit Usage Metrics
- type: sequence
metadata: '{"id":"-7Yvbjavlxb31ialoU2rL","type":"sequence","name":"CPU Credit Usage Conditional Group"}'
condition: attributes["metric_name"] == "CPUCreditUsage"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"KugOmKjlKgXtQNsmjWa1U","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_CPUCreditUsage_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_CPUCreditUsage_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_CPUCreditUsage_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group tracks CPU credit consumption for burstable instance types (T2/T3). Monitoring CPU credit usage helps you determine if your instance is consistently bursting and whether you should upgrade to a larger instance class.
3.1.15. CPU Credit Balance Metrics
- type: sequence
metadata: '{"id":"eQUnO5WeBnbIKUj9ml7Mj","type":"sequence","name":"CPU Credit BalanceConditional Group"}'
condition: attributes["metric_name"] == "CPUCreditBalance"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"eOy6LNPLva-VGj808ETvI","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_CPUCreditBalance_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_CPUCreditBalance_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_CPUCreditBalance_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group monitors the remaining CPU credit balance on burstable instances. A depleted credit balance leads to baseline performance, making this metric essential for preventing performance degradation.
3.1.16. Free Storage Space Metrics
- type: sequence
metadata: '{"id":"CVnzyEPs8zCEWnbPkIjsy","type":"sequence","name":"Free Storage Space Conditional Group"}'
condition: attributes["metric_name"] == "FreeStorageSpace"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"L4RDknPbyFn4vbsk0RCre","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_FreeStorageSpace_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_FreeStorageSpace_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_FreeStorageSpace_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group extracts free storage space metrics. Running out of storage can cause database outages, making this metric critical for capacity planning and alerting.
3.1.17. TempDb Available Data Space Metrics
- type: sequence
metadata: '{"id":"59YAGCIoZk0tI_ekXBQl1","type":"sequence","name":"Temp Db Available Data Space Conditional Group"}'
condition: attributes["metric_name"] == "TempDbAvailableDataSpace"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"lIULCaUeI9Nlm4SL6kSux","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_TempDbAvailableDataSpace_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_TempDbAvailableDataSpace_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_TempDbAvailableDataSpace_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group monitors available space in the TempDB data files (SQL Server specific). TempDB space issues can cause query failures and performance problems, making this metric important for SQL Server instances.
3.1.18. TempDb Data File Usage Metrics
- type: sequence
metadata: '{"id":"X8JW-0VWN-CIEAsJF2V6X","type":"sequence","name":"Temp Db Data File Usage Conditional Group"}'
condition: attributes["metric_name"] == "TempDbDataFileUsage"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"dhm8ydMliUbmhA6_p406d","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_TempDbDataFileUsage_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_TempDbDataFileUsage_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_TempDbDataFileUsage_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group tracks TempDB data file usage percentage. High usage indicates intensive temporary object creation or sorting operations, helping you optimize SQL Server query performance.
3.1.19. Failed SQL Server Agent Jobs Count Metrics
- type: sequence
metadata: '{"id":"6fCN4smqd3UOo2xnMQ-vS","type":"sequence","name":"Failed SQL Server Agent Jobs Count Conditional Group"}'
condition: attributes["metric_name"] == "FailedSQLServerAgentJobsCount"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"VZYbsukrDr9CS4BqfPqgg","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_FailedSQLServerAgentJobsCount_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_FailedSQLServerAgentJobsCount_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_FailedSQLServerAgentJobsCount_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group counts failed SQL Server Agent jobs. Tracking failed jobs helps you quickly identify and remediate automated maintenance or ETL job failures.
3.1.20. TempDb Log File Usage Metrics
- type: sequence
metadata: '{"id":"DP37bXRJLFgGabHtPD0eI","type":"sequence","name":"Temp Db Log File Usage Conditional Group"}'
condition: attributes["metric_name"] == "TempDbLogFileUsage"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"kMk7KYYxJvnv14HhYVNEf","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_TempDbLogFileUsage_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_TempDbLogFileUsage_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_TempDbLogFileUsage_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group monitors TempDB transaction log usage. High log usage can indicate long-running transactions or insufficient log space, helping you prevent TempDB-related outages.
3.1.21. TempDb Available Log Space Metrics
- type: sequence
metadata: '{"id":"HygFcbf5X3Ar6TWXJrQkb","type":"sequence","name":"Temp Db Available Log Space Conditional Group"}'
condition: attributes["metric_name"] == "TempDbAvailableLogSpace"
data_types:
- log
processors:
- type: extract_metric
metadata: '{"id":"bNdFIPvkDdgPGQIYa6sNC","type":"extract_metric","name":"Extract Metric"}'
final: true
data_types:
- log
extract_metric_rules:
- name: rds_TempDbAvailableLogSpace_sum
unit: "1"
gauge:
value: attributes["value"]["sum"]
- name: rds_TempDbAvailableLogSpace_max
unit: "1"
gauge:
value: attributes["value"]["max"]
- name: rds_TempDbAvailableLogSpace_min
unit: "1"
gauge:
value: attributes["value"]["min"]
This group tracks available TempDB log space. Monitoring this metric prevents transaction log full errors that can halt database operations.
After processing through the appropriate conditional group (or passing through if no condition matches), logs flow directly to the Pack Destination (compound_output_861c) compound_output node.
4. Processing Enhanced Monitoring Logs
4.1. RDS Enhanced Metrics Multiprocessor
All logs also flow in parallel to the RDS Enhanced Metrics (sequence_a70a) node, a Multiprocessor node. Enhanced monitoring logs from the Lambda forwarder are more complex than standard metrics because they bundle multiple OS-level metrics within a nested JSON structure inside a logEvents array.
- name: sequence_a70a
type: sequence
user_description: RDS Enhanced Metrics
Important: Only logs containing the Lambda forwarder structure (with cloud, faas, aws, and logEvents fields) can be successfully processed by this multiprocessor. Standard CloudWatch metrics that enter this processor will fail to parse correctly and pass through unchanged. This is by design—the parallel architecture allows both data types to coexist, with each multiprocessor handling only the logs it recognizes.
The multiprocessor performs four stages to prepare these logs for routing:
Stage 1: Parse Outer JSON
- type: ottl_transform
metadata: '{"id":"jMva9IoxFfnP4zVHF-YzL","type":"parse-json","name":"Parse JSON"}'
data_types:
- log
statements: |-
set(cache["parsed-json"], ParseJSON(body))
merge_maps(attributes, cache["parsed-json"], "upsert") where IsMap(attributes) and IsMap(cache["parsed-json"])
set(attributes, cache["parsed-json"]) where not (IsMap(attributes) and IsMap(cache["parsed-json"]))
This first processor parses the outer JSON structure, exposing fields like cloud, faas, aws, and the logEvents array. This makes metadata about the Lambda forwarder and log group accessible. For standard metric streams without these fields, the parsing may partially succeed or fail, allowing the log to pass through.
Stage 2: Unroll JSON Array
- type: json_unroll
metadata: '{"id":"YKCFf3309Obd_khMXN82M","type":"json_unroll","name":"JSON Unroll"}'
data_types:
- log
field_path: body
new_field_name: logDetails
json_field_path: logEvents
The JSON Unroll node extracts individual log entries from the logEvents array. Each entry in the array becomes a separate log item with its content stored in a new field called logDetails. This transformation converts a single log containing multiple events into multiple logs, each representing one event. If the logEvents field doesn’t exist (as with standard metrics), this processor fails gracefully and the log passes through.
Stage 3: Parse Inner JSON
- type: ottl_transform
metadata: '{"id":"8GX2bTUHr8qKHFYDukt91","type":"parse-json","name":"Parse JSON"}'
data_types:
- log
statements: |-
set(cache["parsed-json"], ParseJSON(body))
merge_maps(attributes, cache["parsed-json"], "upsert") where IsMap(attributes) and IsMap(cache["parsed-json"])
set(attributes, cache["parsed-json"]) where not (IsMap(attributes) and IsMap(cache["parsed-json"]))
After unrolling, this processor parses the JSON again to make the newly exposed logDetails fields accessible as attributes.
Stage 4: Copy Message to Body
- type: ottl_transform
metadata: '{"id":"NMjR-ARha-6AbpC95e4GX","type":"copy-field","name":"Copy Field"}'
data_types:
- log
statements: set(body, attributes["logDetails"]["message"])
This OTTL Transform copies the message field from logDetails into the log body. The message contains the actual OS metrics JSON (for RDSOS logs), error messages (for error logs), or slow query data (for slowquery logs), and placing it in the body prepares it for further parsing downstream.
After these four stages, enhanced logs flow to the Route (route_a2f0) node. Standard metrics that entered this multiprocessor will have passed through with minimal changes and also flow to the Route node.
4.2. Route Node
The Route (route_a2f0) node is a Route node that examines the log group name and directs logs to specialized processing paths.
- name: route_a2f0
type: route
user_description: Route
paths:
- path: RDSOSMetrics
condition: item["attributes"]["aws"]["log.group.name"] == "RDSOSMetrics"
exit_if_matched: true
This route node checks if the log originated from the RDSOSMetrics log group. Logs matching this condition are routed to the RDSOSMetrics path and directed to the RDSOS Enhanced Metrics Multi Processor (sequence_7e43). This separation allows you to apply specialized processing to OS-level metrics that require different extraction rules compared to error or slowquery logs.
Logs that do not match the condition (including standard metrics, error logs, slowquery logs, and any other enhanced monitoring logs) are routed on the unmatched path directly to the Pack Destination (compound_output_861c) compound_output node. This ensures all logs are preserved—enhanced logs like errors and slow queries pass through without OS metric extraction, and standard metrics that made it this far continue to the output.
5. Processing RDSOS Enhanced Metrics
5.1. RDSOS Enhanced Metrics Multi Processor
Only logs routed on the RDSOSMetrics path (those with aws.log.group.name == "RDSOSMetrics") flow to the RDSOS Enhanced Metrics Multi Processor (sequence_7e43) node, a Multiprocessor node. This multiprocessor performs specialized processing for OS-level metrics from enhanced monitoring.
- name: sequence_7e43
type: sequence
user_description: RDSOS Enhanced Metrics Multi Processor
The multiprocessor executes five stages:
Stage 1: Parse OS Metrics JSON
- type: ottl_transform
metadata: '{"id":"YwnO_SWoEkwxwcEVLeYv5","type":"parse-json","name":"Parse JSON"}'
data_types:
- log
statements: |-
set(cache["parsed-json"], ParseJSON(body))
merge_maps(attributes, cache["parsed-json"], "upsert") where IsMap(attributes) and IsMap(cache["parsed-json"])
set(attributes, cache["parsed-json"]) where not (IsMap(attributes) and IsMap(cache["parsed-json"]))
This processor parses the OS metrics JSON from the body (which was set by the copy-field operation earlier). After parsing, attributes like engine, instanceID, cpuUtilization, memory, tasks, swap, network, diskIO, fileSys, and processList become accessible.
Stage 2: Remove Duplicate Message Field
- type: ottl_transform
metadata: '{"id":"FSvt4l26Rvwy_iRZ_RI_A","type":"delete-field","name":"Delete Field"}'
data_types:
- log
statements: delete_key(attributes["logDetails"], "message")
This OTTL Transform removes the message field from logDetails since it has already been parsed into top-level attributes. This cleanup reduces data duplication and log verbosity.
Stage 3: Rewrite Body for Clarity
- type: ottl_transform
metadata: '{"id":"zNw_VraP11MnamfI49pkR","type":"ottl_transform","name":"Custom"}'
data_types:
- log
statements: |-
// Add your custom code here
set(body, Concat([attributes["aws"]["log.group.name"], attributes["aws"]["log.subscription_filters"][0], attributes["aws"]["log.stream.name"]], ": "))
This processor replaces the verbose JSON body with a concise summary constructed from the log group name, subscription filter, and stream name. This transformation significantly reduces log size while preserving traceability, making logs easier to read and reducing storage costs.
Stage 4: Extract OS Metrics
- type: extract_metric
metadata: '{"id":"Ap5iXa1n-M6uG2iS0fExb","type":"extract_metric","name":"RDS OS Metrics"}'
keep_item: true
data_types:
- log
extract_metric_rules:
- name: numVCPUs
unit: "1"
gauge:
value: attributes["numVCPUs"]
- name: CPU_total
unit: "1"
gauge:
value: attributes["cpuUtilization"]["total"]
- name: CPU_user
unit: "1"
gauge:
value: attributes["cpuUtilization"]["user"]
- name: Memory_active
unit: "1"
gauge:
value: attributes["memory"]["active"]
- name: Memory_buffers
unit: "1"
gauge:
value: attributes["memory"]["buffers"]
- name: Memory_cached
unit: "1"
gauge:
value: attributes["memory"]["cached"]
- name: Memory_pageTables
unit: "1"
gauge:
value: attributes["memory"]["pageTables"]
This Extract Metric Processor creates gauge metrics from the OS attributes. It extracts:
- numVCPUs: Number of virtual CPUs, helping you correlate CPU usage with instance capacity
- CPU_total: Total CPU utilization percentage across all cores
- CPU_user: User-space CPU utilization, indicating application workload
- Memory_active: Active memory in use by processes, showing real memory demand
- Memory_buffers: Memory used for buffers, indicating I/O caching efficiency
- Memory_cached: Cached memory for file system operations
- Memory_pageTables: Memory consumed by page tables, relevant for large memory workloads
The keep_item: true flag ensures the log itself continues downstream along with the extracted metrics, preserving the full context for archival or further analysis.
Stage 5: Remove Process List
- type: ottl_transform
metadata: '{"id":"Y-3kHu-Ev2tiModpUbnyE","type":"delete-field","name":"Delete Field"}'
data_types:
- log
statements: delete_key(attributes, "processList")
This final processor deletes the processList attribute, which contains detailed per-process metrics that can be extremely verbose (often hundreds of processes). Removing this data reduces log size and noise while retaining the most valuable OS-level metrics. If you need process-level details, you can remove this processor or route these logs before deletion.
After completing these five stages, RDSOS logs flow to the Pack Destination (compound_output_861c) compound_output node.
6. Pack Output
6.1. Pack Destination
The Pack Destination (compound_output_861c) compound_output node is the convergence point where all processed logs exit the pack.
- name: compound_output_861c
type: compound_output
user_description: Pack Destination
According to the links section in content.yaml (lines 665-676), this node receives data from three distinct sources:
- From Standard Metrics Multiprocessor (line 666): All logs after passing through
sequence_b363, whether they matched a metric_name condition or simply passed through unchanged - From Route Node - Unmatched Path (line 670-671): Enhanced logs that did NOT match the RDSOSMetrics condition, including:
- Error logs from log groups like
/aws/rds/cluster/.../error - Slowquery logs from log groups like
/aws/rds/cluster/.../slowquery - Any other Lambda-forwarder logs with log group names other than RDSOSMetrics
- Standard metric streams that flowed through the Enhanced Metrics path (having failed to unroll or transform)
- Error logs from log groups like
- From RDSOS Multiprocessor (line 675-676): RDSOS enhanced metrics after completing the five-stage OS metric extraction pipeline
This convergence architecture ensures that every log entering the pack exits through this single output, regardless of which processing path it took or whether it was successfully transformed. Compound_output nodes do not transform or store data; they simply route logs to downstream processors, destinations, or archives configured outside the pack. All metrics extracted by the pack (from both Standard and RDSOS multiprocessors) are sent to your configured metric destinations, while log data can be forwarded to archival storage or SIEM systems.
Sample Input
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"DiskSpaceAvailable","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1753909380000,"value":{"max":88035456,"min":88035456,"sum":88035456,"count":1},"unit":"Kilobytes"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"FreeableMemory","dimensions":{"DBInstanceIdentifier":"itc-rds-instance"},"timestamp":1753909440000,"value":{"max":480423936,"min":480423936,"sum":480423936,"count":1},"unit":"Bytes"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"FailedSQLServerAgentJobsCount","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1753909440000,"value":{"max":0,"min":0,"sum":0,"count":1},"unit":"Count"}
{"cloud":{"resource_id":"arn:aws:lambda:us-west-2:876198360267:function:EdgeDelta-Forwarder-nmp-nonprod-rds","account_id":"876198360267","region":"us-west-2"},"faas":{"name":"EdgeDelta-Forwarder-nmp-nonprod-rds","version":"$LATEST","request_id":"a147663a-732a-4665-a36c-8edd39e91750","memory_size":"128"},"aws":{"log.group.name":"/aws/rds/cluster/int-storyline-20240313-cluster/error","log.group.arn":"arn:aws:logs:us-west-2:876198360267:log-group:/aws/rds/cluster/int-storyline-20240313-cluster/error","log.stream.name":"int-storyline-20240313","log.message_type":"DATA_MESSAGE","log.subscription_filters":["NPM nonprod RDS - error"]},"host.arch":"arm64","process.runtime.name":"provided.al2","logEvents":[{"id":"39113470754740317048371165885430661824953729552050159616","timestamp":1753908688097,"message":"2025-07-30T20:51:28.097554Z 0 [Note] [MY-000000] [Repl] [Dump thread metrics] Secondary_id: 5448, Secondary_uuid: , Binlog_file: mysql-bin-changelog.008564, Binlog_position: 126303586, Bytes_behind_primary: 3447, Bytes_behind_primary (3447) is smaller than aurora_binlog_io_cache_size (134217728) by 134214281 (rpl_binlog_sender.cc:1945)"}]}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"CPUUtilizationUser","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1753909380000,"value":{"max":7.29,"min":7.29,"sum":7.29,"count":1},"unit":"Percent"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"CPUUtilization","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1753909380000,"value":{"max":14.041107298710818,"min":14.041107298710818,"sum":14.041107298710818,"count":1},"unit":"Percent"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"Threads","dimensions":{},"timestamp":1753909380000,"value":{"max":773,"min":773,"sum":773,"count":1},"unit":"Count"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"PageLifeExpectancy","dimensions":{},"timestamp":1753909380000,"value":{"max":875,"min":875,"sum":875,"count":1},"unit":"Count"}
{"cloud":{"resource_id":"arn:aws:lambda:us-west-2:876198360267:function:EdgeDelta-Forwarder-nmp-nonprod-rds","account_id":"876198360267","region":"us-west-2"},"faas":{"name":"EdgeDelta-Forwarder-nmp-nonprod-rds","version":"$LATEST","request_id":"9c23d586-72f4-4b62-ba4f-af9559d1d9ec","memory_size":"128"},"aws":{"log.group.name":"RDSOSMetrics","log.group.arn":"arn:aws:logs:us-west-2:876198360267:log-group:RDSOSMetrics","log.stream.name":"db-BOXGFHNVJI5TQ5BMRXQSXZ7GWI","log.message_type":"DATA_MESSAGE","log.subscription_filters":["nmp_nonprod_rds_metrics"]},"host.arch":"arm64","process.runtime.name":"provided.al2","logEvents":[{"id":"39113467139856422602152746314604247557822063277996507136","timestamp":1753908526000,"message":"{\"engine\":\"Aurora\",\"instanceID\":\"int-auth-20201106\",\"instanceResourceID\":\"db-BOXGFHNVJI5TQ5BMRXQSXZ7GWI\",\"timestamp\":\"2025-07-30T20:48:46Z\",\"version\":1,\"uptime\":\"517 days, 01:29:24\",\"numVCPUs\":2,\"cpuUtilization\":{\"guest\":0.0,\"irq\":0.0,\"system\":2.3,\"wait\":0.1,\"idle\":92.8,\"user\":3.9,\"total\":7.2,\"steal\":0.0,\"nice\":0.9},\"loadAverageMinute\":{\"one\":0.27,\"five\":0.13,\"fifteen\":0.18},\"memory\":{\"writeback\":0,\"hugePagesFree\":1,\"hugePagesRsvd\":0,\"hugePagesSurp\":0,\"cached\":4913668,\"hugePagesSize\":2048,\"free\":210088,\"hugePagesTotal\":4065,\"inactive\":5746684,\"pageTables\":8784,\"dirty\":412,\"mapped\":227356,\"active\":1035080,\"total\":16069636,\"slab\":675852,\"buffers\":497712},\"tasks\":{\"sleeping\":102,\"zombie\":0,\"running\":0,\"stopped\":0,\"total\":102,\"blocked\":0},\"swap\":{\"cached\":12,\"total\":8388604,\"free\":8388348,\"in\":0.0,\"out\":0.0},\"network\":[{\"interface\":\"eth0\",\"rx\":1728.08,\"tx\":18342.82}],\"diskIO\":[{\"readLatency\":0.0,\"writeLatency\":0.9,\"writeThroughput\":17372.83,\"readThroughput\":0.0,\"readIOsPS\":0.0,\"writeIOsPS\":3.75,\"diskQueueDepth\":0},{\"writeKbPS\":4.07,\"readIOsPS\":0.0,\"await\":0.73,\"readKbPS\":0.0,\"rrqmPS\":0.0,\"util\":0.08,\"avgQueueLen\":0.0,\"tps\":1.0,\"readKb\":0,\"device\":\"rdstemp\",\"writeKb\":244,\"avgReqSz\":8.13,\"wrqmPS\":0.0,\"writeIOsPS\":1.0}],\"fileSys\":[{\"used\":361832,\"name\":\"oscar--ephmeral--volume--group-oscar--ephmeral--logical--volume\",\"usedFiles\":1362,\"usedFilePercent\":0.06,\"maxFiles\":2097152,\"mountPoint\":\"/rdsdbdata\",\"total\":32839440,\"usedPercent\":1.1}],\"processList\":[{\"vss\":1469532,\"name\":\"OS processes\",\"tgid\":0,\"parentID\":0,\"memoryUsedPc\":0.52,\"cpuUsedPc\":0.09,\"id\":0,\"rss\":83008,\"vmlimit\":0},{\"vss\":8445532,\"name\":\"RDS processes\",\"tgid\":0,\"parentID\":0,\"memoryUsedPc\":3.51,\"cpuUsedPc\":3.64,\"id\":0,\"rss\":563452,\"vmlimit\":0},{\"vss\":8833028,\"name\":\"Aurora Storage Daemon\",\"tgid\":10480,\"parentID\":1,\"memoryUsedPc\":1.58,\"cpuUsedPc\":0.42,\"id\":10480,\"rss\":254256,\"vmlimit\":\"unlimited\"},{\"vss\":9674956,\"name\":\"aurora\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":259,\"rss\":859060,\"vmlimit\":\"unlimited\"},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.01,\"id\":260,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":261,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: AwsEventLoop 1\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":262,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":263,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":264,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.04,\"id\":272,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.04,\"id\":273,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: boot\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":274,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: boot\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":275,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_io_ibuf\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":279,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_io_log\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":280,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_io_rd-1\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":281,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_io_wr-1\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":282,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_io_wr-2\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":283,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_io_wr-3\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":284,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_io_wr-4\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":285,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_lra-0\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":286,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_akp-0\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":287,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_srv_lock_to\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":291,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_srv_err_mon\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":292,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_srv_mon\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":293,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_buf_resize\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":296,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_btr_tggl-0\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":297,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_src_main\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":298,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_dict_stats\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":299,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_fts_opt\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":300,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_dct_md_tb-0\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.03,\"id\":301,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":302,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.03,\"id\":303,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_clone_gtid\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.01,\"id\":307,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: ib_srv_purge\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.44,\"id\":308,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":309,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":310,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":311,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":312,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":313,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: evt_sched\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":314,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: sig_handler\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":315,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: gtid_zip\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":317,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":318,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":319,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":320,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":321,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: mysqld\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.07,\"id\":322,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.03,\"id\":324,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":326,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.01,\"id\":328,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.01,\"id\":329,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.04,\"id\":339,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":350,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.01,\"id\":26416,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.01,\"id\":8559,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.01,\"id\":8560,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":8561,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.01,\"id\":8562,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":740,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":759,\"rss\":859060,\"vmlimit\":0},{\"vss\":9674956,\"name\":\"aurora: connection\",\"tgid\":259,\"parentID\":203,\"memoryUsedPc\":5.35,\"cpuUsedPc\":0.0,\"id\":761,\"rss\":859060,\"vmlimit\":0}]}"}]}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"WriteLatency","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1754053320000,"value":{"max":0.001487346482463181,"min":0.001487346482463181,"sum":0.001487346482463181,"count":1},"unit":"Seconds"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"ReadIOPS","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1754053140000,"value":{"max":0,"min":0,"sum":0,"count":1},"unit":"Count/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"DiskReadRate","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1753909380000,"value":{"max":2.88,"min":2.88,"sum":2.88,"count":1},"unit":"Count/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"DatabaseConnections","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1753993260000,"value":{"max":12,"min":12,"sum":12,"count":1},"unit":"Count"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"DiskSpaceAvailability","dimensions":{},"timestamp":1753909380000,"value":{"max":84.06,"min":84.06,"sum":84.06,"count":1},"unit":"Percent"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"TempDbLogFileUsage","dimensions":{"DatabaseClass":"db.t3.medium"},"timestamp":1753909440000,"value":{"max":24.51171875,"min":24.51171875,"sum":24.51171875,"count":1},"unit":"Percent"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"ProcessesBlocked","dimensions":{},"timestamp":1753967400000,"value":{"max":5E-324,"min":0,"sum":0,"count":1},"unit":"Count"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"TempDbAvailableLogSpace","dimensions":{"DBInstanceIdentifier":"itc-rds-instance"},"timestamp":1753909440000,"value":{"max":90154639360,"min":90154639360,"sum":90154639360,"count":1},"unit":"Bytes"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"WriteIOPS","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1754053620000,"value":{"max":7,"min":7,"sum":7,"count":1},"unit":"Count/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"NetworkTransmitted","dimensions":{"DBInstanceIdentifier":"itc-rds-instance"},"timestamp":1753909380000,"value":{"max":105598.93,"min":105598.93,"sum":105598.93,"count":1.0},"unit":"Bytes/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"BurstBalance","dimensions":{"DBInstanceIdentifier":"itc-rds-instance"},"timestamp":1753967400000,"value":{"max":99,"min":99,"sum":99,"count":1},"unit":"Percent"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"NetworkTransmitThroughput","dimensions":{"DatabaseClass":"db.t3.medium"},"timestamp":1754053860000,"value":{"max":75134,"min":75134,"sum":75134,"count":1},"unit":"Bytes/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"WriteThroughput","dimensions":{"DatabaseClass":"db.t3.medium"},"timestamp":1754053320000,"value":{"max":2382413,"min":2382413,"sum":2382413,"count":1},"unit":"Bytes/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"WriteTransactions","dimensions":{"DBInstanceIdentifier":"itc-rds-instance"},"timestamp":1753909380000,"value":{"max":0.18333125204543452,"min":0.18333125204543452,"sum":0.18333125204543452,"count":1.0},"unit":"Count/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"DBLoad","dimensions":{},"timestamp":1753909440000,"value":{"max":2,"min":0,"sum":64,"count":60},"unit":"None"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"ForwardedRecords","dimensions":{"DBInstanceIdentifier":"itc-rds-instance"},"timestamp":1753909380000,"value":{"max":5E-324,"min":0,"sum":0,"count":1},"unit":"Count/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"MemoryPhysicalAvailable","dimensions":{},"timestamp":1753909380000,"value":{"max":503668,"min":503668,"sum":503668,"count":1},"unit":"Kilobytes"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"MemoryPhysical","dimensions":{"DBInstanceIdentifier":"itc-rds-instance"},"timestamp":1753909380000,"value":{"max":4132380,"min":4132380,"sum":4132380,"count":1},"unit":"Kilobytes"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"ReadThroughput","dimensions":{},"timestamp":1754053320000,"value":{"max":136,"min":136,"sum":136,"count":1},"unit":"Bytes/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"EBSByteBalance%","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1753909200000,"value":{"max":99.5,"min":99.5,"sum":99.5,"count":1.0},"unit":"Percent"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"CPUUtilizationKernel","dimensions":{},"timestamp":1753909380000,"value":{"max":3.74,"min":3.74,"sum":3.74,"count":1.0},"unit":"Percent"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"TempDbDataFileUsage","dimensions":{"DatabaseClass":"db.t3.medium"},"timestamp":1753909440000,"value":{"max":0.09108169129720854,"min":0.09108169129720854,"sum":0.09108169129720854,"count":1},"unit":"Percent"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"DiskSpaceUtilization","dimensions":{},"timestamp":1753909380000,"value":{"max":15.94,"min":15.94,"sum":15.94,"count":1.0},"unit":"Percent"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"DiskWriteRate","dimensions":{},"timestamp":1753909380000,"value":{"max":6.47,"min":6.47,"sum":6.47,"count":1.0},"unit":"Count/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"ReadLatency","dimensions":{"DatabaseClass":"db.t3.medium"},"timestamp":1754053320000,"value":{"max":0.0009039762080647051,"min":0.0009039762080647051,"sum":0.0009039762080647051,"count":1},"unit":"Seconds"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"Handles","dimensions":{"DBInstanceIdentifier":"itc-rds-instance"},"timestamp":1753967400000,"value":{"max":24219,"min":24219,"sum":24219,"count":1},"unit":"Count"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"DiskQueueDepth","dimensions":{"DBInstanceIdentifier":"itc-rds-instance"},"timestamp":1754053860000,"value":{"max":0,"min":0,"sum":0,"count":1},"unit":"Count"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"CPUSurplusCreditBalance","dimensions":{"DatabaseClass":"db.t3.medium"},"timestamp":1753909200000,"value":{"max":0.0,"min":0.0,"sum":0.0,"count":1.0},"unit":"Count"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"PageLookups","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1753909380000,"value":{"max":8427.620991186413,"min":8427.620991186413,"sum":8427.620991186413,"count":1},"unit":"Count/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"NetworkReceiveThroughput","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1754053860000,"value":{"max":758308,"min":758308,"sum":758308,"count":1},"unit":"Bytes/Second"}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"PageReads","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1753967400000,"value":{"max":0.1333340433017957,"min":0.1333340433017957,"sum":0.1333340433017957,"count":1},"unit":"Count/Second"}
{"cloud":{"resource_id":"arn:aws:lambda:us-west-2:876198360267:function:EdgeDelta-Forwarder-nmp-nonprod-rds","account_id":"876198360267","region":"us-west-2"},"faas":{"name":"EdgeDelta-Forwarder-nmp-nonprod-rds","version":"$LATEST","request_id":"ec7cb853-1663-431d-a068-68a743a3b076","memory_size":"128"},"aws":{"log.group.name":"/aws/rds/cluster/int-storyline-20240313-cluster/slowquery","log.group.arn":"arn:aws:logs:us-west-2:876198360267:log-group:/aws/rds/cluster/int-storyline-20240313-cluster/slowquery","log.stream.name":"int-storyline-20240313","log.message_type":"DATA_MESSAGE","log.subscription_filters":["nmp nonprod RDS - slowquery"]},"host.arch":"arm64","process.runtime.name":"provided.al2","logEvents":[{"id":"39113470000462212198469899327016247178023981874983862272","timestamp":1753908654274,"message":"# Time: 2025-07-30T20:50:54.274601Z\n# User@Host: int_v1_rw[int_v1_rw] @ [10.50.147.230] Id: 39208831\n# Query_time: 4.864294 Lock_time: 0.000003 Rows_sent: 25270 Rows_examined: 169441\nSET timestamp=1753908649;\nSELECT\n cp.uuid AS uuid_site,\n cp.domain_name AS domain,\n cp.uuid_brand AS uuid_brand,\n cp.status AS site_status,\n sp.uuid AS uuid_section,\n sp.name AS section_name,\n getSectionPropertyNavigationPathUrl(sp.uuid) AS navigation_path,\n sp.uuid_parent_section AS uuid_parent_section,\n sp.status AS section_status,\n sp.redirect_path_url AS redirect_path_url,\n IF(pa.value = 'false', FALSE, TRUE) AS targetable\nFROM property AS sp\n JOIN property AS cp ON sp.uuid_channel_property = cp.uuid\n LEFT JOIN property_attributes pa ON sp.uuid = pa.uuid_property AND pa.name='TARGETABLE'\nWHERE sp.type = 'SCTNPRPRTYMDL';"}]}
{"metric_stream_name":"QuickPartial-hS9ahC","account_id":"714688865413","region":"us-east-1","namespace":"AWS/RDS","metric_name":"PageSize","dimensions":{"EngineName":"sqlserver-ex"},"timestamp":1753909380000,"value":{"max":4096,"min":4096,"sum":4096,"count":1},"unit":"Bytes"}