This script fetches logs from an AWS EKS cluster log group, filters for "error" messages, counts the events, and appends the timestamp and events count to a data file for a specified time range.

fetch_logs_plot_errors.sh

#!/bin/bash

: '
This script fetches logs from an AWS EKS cluster log group, filters for "error" messages, counts the events, and appends the timestamp and events count to a data file for a specified time range.
The time range is defined by the start_time and end_time variables, and the script iterates over each minute in this range.
The output data file is used to plot a graph using gnuplot, with time on the x-axis and events count on the y-axis.

This script requires that `awscli`, `jq` and `gnuplot` be installed in your environment. 
It also requires that you have access to the specified AWS EKS cluster log group.
'

# Set the log group name (ex: /aws/eks/<clustername>/cluster)
log_group_name="<update me>"

# Start and end times in 'YYYY-MM-DD hh:mm:ss' format
start_time="2023-06-27 13:00:00"
end_time="2023-06-27 14:00:00"

# Convert times to Unix timestamp (seconds)
start_time=$(date -j -f "%Y-%m-%d %T" "$start_time" +%s)
end_time=$(date -j -f "%Y-%m-%d %T" "$end_time" +%s)

# Delete the old data file
rm -f /tmp/datafile.dat

# Loop over each minute in the given range
for (( time=$start_time; time<=$end_time; time+=60 ))
do
  # Convert current time to milliseconds
  start_time_millis=$((time*1000))
  end_time_millis=$(((time+60)*1000))
  
  # Fetch logs for the current minute, filter for "error", and count the events
  events_count=$(aws logs filter-log-events \
    --log-group-name $log_group_name \
    --start-time $start_time_millis \
    --end-time $end_time_millis | jq -r '.events[] | select(.message | contains("error"))' | jq -s 'length')

  # Append the timestamp and events count to the data file
  echo "$time $events_count" >> /tmp/datafile.dat
done

gnuplot -persist -e "set timefmt '%s'; set xdata time; set format x '%H:%M'; plot '/tmp/datafile.dat' using 1:2 with linespoints"