CloudWatch Insights Syntax - Sum() Bytes

Question

I am trying to use CW Insights to look at VPC Flow Logs and am confused about how to use the sum() stats function, and the documentation is pretty light. In the example below I am limiting my fields and filtering only the traffic to port 22 -- this works fine.

However, I would like to sum the bytes for each interfaceId and my query below returns nothing. After reading the docs I haven't found a syntax explanation, and appreciate help.

fields @timestamp,srcAddr,dstAddr,srcPort,dstPort,bytes, interfaceId
| filter dstPort = 22
| sum(bytes) by interfaceId

Answer 1

sum(), avg(), count(), min() and max() require the stats query command in front of them.

Try this:

fields @timestamp,srcAddr,dstAddr,srcPort,dstPort,bytes, interfaceId
| filter dstPort = 22
| stats sum(bytes) by interfaceId

Docs and sample queries