AWS CloudWatch Custom Dashboards: EC2 Metrics, Tags, and Logs Insights

Purpose of This Lesson

This lesson demonstrates how to create custom Amazon CloudWatch dashboards for operational monitoring. The workflow covers:

• Launching temporary EC2 instances with a consistent tag.
• Creating an Explorer-based CloudWatch dashboard.
• Filtering EC2 data by resource tags and instance family.
• Adding CloudWatch Logs Insights query results as a dashboard widget.
• Saving and switching between dashboards for different monitoring views.
• Cleaning up lab resources after completion.

The main operational idea is to organize dashboard data around a meaningful resource scope, such as all instances belonging to a department or all instances in a particular instance family.

Key Concepts

CloudWatch dashboards

A CloudWatch dashboard is a customizable collection of widgets that presents monitoring data in one place. A dashboard can contain metrics, logs, alarms, and other supported content.

Dashboards are useful when a team needs a repeatable operational view rather than repeatedly searching for individual metrics or log data.

Explorer widgets

The CloudWatch Explorer widget helps organize and display metrics for groups of resources. It can be populated using filters based on resource tags and properties.

In this lab, the Explorer widget is used with EC2 data and then scoped using filters such as:

• department = operations
• Instance family T2

Resource filtering

Filtering by a tag allows a dashboard to follow an operational grouping that is meaningful to the organization. For example, a dashboard filtered by department=operations can show data for all matching EC2 instances without manually selecting each instance.

Filtering by an instance property, such as instance family, provides a technical grouping. A dashboard for T2 instances can include all matching instances in CloudWatch, regardless of their department tag.

CloudWatch Logs Insights dashboard widgets

A Logs table widget can be based on a CloudWatch Logs Insights query. The query is executed against a selected log group, and the resulting log data can be added to a dashboard.

This allows a dashboard to combine numeric monitoring data with application or web-server log information. In the lab, an Apache HTTPD access-log query is added to a dashboard for T2 instances.

Building CloudWatch Dashboards for EC2 Operations

1. Prepare tagged EC2 resources

The lab begins by launching two T2 micro EC2 instances with the tag:

Key: department
Value: operations

The launch command is supplied in the course download under the CloudWatch directory. Before running it in AWS CloudShell, update the AMI ID so it uses the current AMI required by the lab. After launching the instances, verify in the EC2 console that both instances are running and have the expected tag.

The tag is important because it becomes the selection criterion for the first dashboard.

2. Create an operations dashboard

In the CloudWatch console:

1. Open Dashboards.
2. Choose Create dashboard.
3. Name the dashboard operations.
4. Select CloudWatch as the data source.
5. Choose Metrics.
6. Select the Explorer widget type.
7. Use the EC2 Explorer template.

The template establishes the general EC2 visualization, but it does not automatically identify the exact resources to display.

3. Filter the Explorer widget by tag

Use the widget’s gear icon to configure the resource scope. Expand or inspect the available metric and resource options, then select the tag filter:

Department = operations

The Explorer graphs should now populate with data for the EC2 instances carrying that tag. Newly launched or mostly idle instances may show only a small number of data points or low activity; that does not necessarily indicate a dashboard problem.

4. Create an instance-family dashboard

A second dashboard can provide a different operational perspective:

1. Create another dashboard, such as all T2 instances.
2. Add an EC2 Explorer widget.
3. Open the widget configuration using the gear icon.
4. Filter by the instance family property.
5. Select T2.
6. Save the dashboard.

This dashboard is broader than the tag-based dashboard. It includes CloudWatch data for T2 instances rather than only instances assigned to the operations department.

The two dashboards demonstrate how the same service can be viewed through different scopes:

• Organizational scope: instances tagged for a department.
• Technical scope: instances belonging to an instance family.

5. Add log data to a dashboard

CloudWatch dashboards can include log query results as well as metrics.

To add an Apache access-log view:

1. Add a new widget to the dashboard.
2. Select Logs.
3. Choose a Logs table.
4. Continue to Logs Insights.
5. Select the relevant application web-server HTTPD access log group.
6. Paste or enter the supplied Logs Insights query.
7. Run the query to validate it.
8. Save the query as HTTP logs.
9. Choose Add to dashboard.
10. Select the all T2 instances dashboard.

The query may initially show no results for the selected time range. The dashboard widget can still display historical results when the relevant log data and time range are available. The query must target the correct log group, and the dashboard time range must include the period in which the web-server activity occurred.

Exam- or Assessment-Relevant Takeaways

For CloudOps-oriented assessment scenarios, recognize the following decisions:

• Use a CloudWatch dashboard when operators need a persistent, consolidated view of monitoring data.
• Use an Explorer widget when the view should cover groups of resources selected by tags or resource properties.
• Use a tag filter when the desired scope is based on an organizational or workload grouping, such as a department.
• Use an instance-family filter when the desired scope is based on EC2 characteristics such as T2.
• Use a Logs table and CloudWatch Logs Insights when the dashboard must display query-based log results rather than only metric graphs.
• A dashboard widget can be created from a saved Logs Insights query and added to an existing dashboard.
• An empty or sparse result set can be caused by low instance activity or an unsuitable time range; it is not automatically evidence that CloudWatch is malfunctioning.
• Temporary lab instances should be terminated after testing to avoid leaving unnecessary resources running.

These are scenario-recognition points derived from the lab workflow, not a claim that every item is a separately stated official exam objective.

Tool / Feature Decision Guide

Requirement	Suitable choice	Reason
Monitor EC2 resources assigned to an operational group	EC2 Explorer filtered by tag	Tags represent the desired organizational scope.
Monitor every EC2 instance in a technical category	EC2 Explorer filtered by instance family	The filter uses an EC2 property rather than an organizational tag.
Display CloudWatch metric data	Metrics widget or Explorer widget	Metrics provide numerical monitoring data; Explorer is useful for grouped resource views.
Display web-server or application log results	Logs table backed by Logs Insights	The widget presents results from a log query.
Investigate why a widget appears empty	Check activity, selected log group, and time range	Sparse activity or an unsuitable time range can explain missing results.
Create a reusable monitoring view	Save the dashboard and its query	Operators can return to the same filtered view instead of rebuilding it.

Common Traps / Misconceptions

• Assuming the Explorer template already selects resources: The template supplies the visualization structure, but the widget still needs a resource filter.
• Confusing tags with instance properties: department=operations is a tag-based organizational filter; T2 is an instance-family property filter. They produce different resource sets.
• Treating a lack of current results as a failed query: The instances may simply be idle, or the selected time range may not include the activity.
• Using the wrong log group: A Logs Insights query must be run against the log group containing the expected records, such as the application web-server HTTPD access log group used in the lab.
• Expecting a metric dashboard to show log records automatically: Logs require a Logs widget and a Logs Insights query; they are not the same as metric graphs.
• Forgetting to save or add the query to a dashboard: Running a query in Logs Insights does not by itself place the results on a dashboard.
• Leaving lab instances running: The workflow ends with terminating the temporary EC2 instances and confirming that the lab is cleaned up.

Real-World Engineer / Analyst Notes

• Choose filters that match how the organization operates. Department, application, environment, and ownership tags can make dashboards easier to maintain than manually selected instance IDs.
• A tag-based dashboard is only as reliable as the tagging discipline behind it. New resources will not appear in the intended view if they lack the expected tag.
• Technical filters and organizational filters answer different questions. A T2 dashboard may include resources owned by many departments, while an operations dashboard may contain multiple instance types.
• Combining metrics and logs creates a more useful troubleshooting view: metrics can show resource behavior while Logs Insights exposes request or application evidence.
• Always validate the log group and time range before changing a query when no records appear.
• Dashboards should be saved with names that communicate their scope, such as operations, all T2 instances, or HTTP logs.
• Temporary test workloads should be terminated after the exercise. Cleanup is part of responsible cloud operations, not an optional final step.

Quick Reference Summary

• Create dashboards from CloudWatch → Dashboards → Create dashboard.
• CloudWatch dashboard content can include metrics, logs, and alarms.
• The Explorer widget can be prefilled with an EC2 template.
• Use the widget’s gear icon to configure resource filters.
• Tag-based example: department=operations.
• Property-based example: instance family T2.
• Add log results through Logs → Logs table → Logs Insights.
• Select the correct log group, validate the query, save it, and use Add to dashboard.
• If results are missing, check resource activity and the time range before assuming a configuration error.
• Terminate temporary EC2 instances when the lab is complete.

Flashcards

Q: You need a dashboard showing all EC2 instances assigned to the operations department, even if their instance types differ. Which filter should you use?

A: Use the EC2 Explorer widget with the tag filter department=operations. The requirement is based on an organizational tag, not an instance property.

Q: When would you choose an instance-family filter instead of a tag filter in a CloudWatch Explorer widget?

A: Choose an instance-family filter when the monitoring scope is technical, such as all T2 instances. Choose a tag filter when the scope is based on ownership, department, or workload grouping.

Q: What does an EC2 Explorer template provide when creating a CloudWatch dashboard?

A: It provides the initial EC2 visualization structure. You still need to configure the specific resources or filters whose data should be displayed.

Q: A newly launched EC2 dashboard shows very few data points. What is the first operational explanation to consider?

A: The instances may have little or no activity, so there may be limited metric data to display. Also confirm that the selected time range is appropriate.

Q: How can CloudWatch Logs Insights results be displayed on a dashboard?

A: Add a Logs table widget, select the appropriate log group, run the Logs Insights query, save it if needed, and choose Add to dashboard.

Q: What is the decisive difference between the operations dashboard and the all T2 instances dashboard in this lab?

A: The operations dashboard selects resources by the department=operations tag, while the T2 dashboard selects resources by the EC2 instance-family property.

Q: A Logs Insights query returns no records. Which checks are most relevant before rewriting the query?

A: Verify the selected log group and time range, and confirm that activity occurred during that period. An empty result does not automatically mean the query syntax is wrong.

Q: Why combine metric widgets with log widgets on the same CloudWatch dashboard?

A: Metrics provide quantitative resource or service behavior, while log queries provide detailed application or web-server evidence. Together they support faster operational investigation.

Q: What must be updated before running the lab’s EC2 launch command?

A: Update the AMI ID in the supplied launch command so it uses the current AMI required by the lab. The command launches T2 micro instances with the operations department tag.

Q: What is the trap when using a Logs table widget with an HTTPD access-log query?

A: Selecting the wrong log group or an unsuitable time range can make valid query logic appear to return no data. The query must target the log group containing the Apache access records.

Q: How do you make a Logs Insights result reusable from a dashboard?

A: Save the query and add it to the desired dashboard. Running it interactively alone does not create a persistent dashboard widget.

Q: Why might a T2 dashboard contain more data than the operations dashboard?

A: The T2 filter can include every matching T2 instance in CloudWatch, whereas the operations dashboard includes only instances carrying the department=operations tag.

Practice Questions

Question 1

An operations team wants a CloudWatch dashboard that automatically includes EC2 instances assigned to its department as new instances are launched. Which configuration best matches the requirement?

A. Manually add each instance ID to a metric widget
B. Use an EC2 Explorer widget filtered by department=operations
C. Use a Logs table without selecting a log group
D. Filter by instance family T2 only

Correct answer: B

The decisive clue is the department-based grouping. A tag filter lets the Explorer view target resources using the department=operations tag rather than a fixed list of instance IDs.

Question 2

An engineer wants to review all T2 instance activity, including instances that belong to departments other than operations. Which dashboard filter should be used?

A. Tag department=operations
B. Apache HTTPD access logs only
C. Instance family T2
D. A manually selected operations dashboard

Correct answer: C

The requirement is based on an EC2 technical property, not department ownership. Filtering by instance family T2 produces the broader technical view.

Question 3

A saved Logs Insights query for Apache access logs shows no results when first run. Which action is most appropriate before concluding that the query is invalid?

A. Delete the CloudWatch dashboard
B. Check the selected log group and time range
C. Replace the EC2 Explorer widget with an alarm
D. Change the instance family to T2

Correct answer: B

The lab notes that missing results can be caused by the selected time range or by querying the wrong log group. These should be validated before changing the query or dashboard design.

Question 4

You have validated an HTTPD Logs Insights query and want its results visible on the existing all T2 instances dashboard. What should you do next?

A. Choose Add to dashboard and select all T2 instances
B. Add the query as an EC2 tag
C. Relaunch the EC2 instances without tags
D. Convert the query into an AMI

Correct answer: A

The Logs Insights workflow provides an Add to dashboard action that places the query result into the selected dashboard.

Question 5

After completing the dashboard lab, what is the appropriate cleanup action for the temporary EC2 resources?

A. Leave them running so CloudWatch can collect more data indefinitely
B. Delete the dashboards before stopping the instances
C. Terminate the temporary instances
D. Remove only the department tag

Correct answer: C

The lab uses temporary instances and explicitly ends with terminating them so the environment is cleaned up.

WordPress Metadata

Suggested Slug:
aws-cloudwatch-custom-dashboards-ec2-metrics-logs-insights

Meta Description:
Build CloudWatch dashboards that filter EC2 metrics by tags or instance family and add CloudWatch Logs Insights results as dashboard widgets.

Tags:
AWS CloudWatch, CloudWatch Dashboards, CloudWatch Metrics, CloudWatch Logs, CloudWatch Logs Insights, Amazon EC2, EC2 Tags, AWS CloudOps, Monitoring, Operational Dashboards