aws-cloudwatch-investigation
Reusable investigation patterns for AWS CloudWatch: Logs Insights query templates, alarm-to-deployment correlation, blast-radius narrowing decision tree, and PromQL-style metric query patterns for structured incident triage.
Profile →npx skills add github/awesome-copilot --skill aws-cloudwatch-investigation --agent copilot
Same command for any agent — swap --agent for claude-code, codex, cursor.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# AWS CloudWatch Investigation Skill Reusable patterns for investigating production incidents using CloudWatch Logs, Metrics, and Alarms. These patterns are designed to be composed together during incident triage. --- ## Pattern 1: Logs Insights Query Templates ### Error Spike Detection Find the top errors in a time window, grouped by error type: ``` fields @timestamp, @message, @logStream | filter @message like /(?i)(error|exception|fatal|critical)/ | stats count(*) as errorCount by bin(5m), @logStream | sort errorCount desc | limit 20 ``` ### P99 Latency Breakdown by Operation Identify which operations are driving latency spikes: ``` fields @timestamp, @duration, operation | filter ispresent(@duration) | stats avg(@duration) as avgMs, pct(@duration, 50) as p50Ms, pct(@duration, 95) as p95Ms, pct(@duration, 99) as p99Ms, count(*) as invocations by operation | sort p99Ms desc | limit 15 ``` ### Lambda Cold Start Detection Quantify cold start impact during an incident: ``` fields @timestamp, @duration, @initDuration, @memorySize, @maxMemoryUsed | filter ispresent(@initDuration) | stats count(*) as coldStarts, avg(@initDuration) as avgInitMs, max(@initDuration) as maxInitMs, avg(@dur
- Pattern 1: Logs Insights Query Templates
- Error Spike Detection
- P99 Latency Breakdown by Operation
- Lambda Cold Start Detection
- Out-of-Memory (OOM) Detection
- Timeout Detection
- Pattern 2: Alarm History to Deploy-Event Correlation
- Process
- Output Format
- Pattern 3: Narrow the Blast Radius Decision Tree
- Shared Dependency Investigation
- Pattern 4: PromQL-Style Metric Query Patterns
- Error Rate as Percentage
- Latency Anomaly Detection (Compare to Baseline)
What does the aws-cloudwatch-investigation skill do?
Reusable investigation patterns for AWS CloudWatch: Logs Insights query templates, alarm-to-deployment correlation, blast-radius narrowing decision tree, and PromQL-style metric query patterns for structured incident triage.
How do I install it?
Run `npx skills add github/awesome-copilot --skill aws-cloudwatch-investigation --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From github/awesome-copilot, a repository with 37,432 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.