Smaws_Client_CloudWatchLogs.TypesOne of the parameters for the request is not valid.
type nonrec upper_case_string_with_keys = with_key listtype nonrec upper_case_string = {with_keys : upper_case_string_with_keys;The array of containing the keys of the field to convert to uppercase.
*)}This processor converts a string field to uppercase.
For more information about this processor including examples, see upperCaseString in the CloudWatch Logs User Guide.
type nonrec scheduled_query_log_group_identifiers = log_group_identifier listtype nonrec start_time_offset = Smaws_Lib.CoreTypes.Int64.ttype nonrec end_time_offset = Smaws_Lib.CoreTypes.Int64.ttype nonrec s3_configuration = {kms_key_id : kms_key_id option;The Amazon Resource Name (ARN) of the KMS encryption key. Must belong to the same Amazon Web Services Region as the destination Amazon S3 bucket.
*)owner_account_id : account_id option;The Amazon Web Services accountId for the bucket owning account.
*)role_arn : role_arn;The ARN of the IAM role that grants permissions to write query results to the specified Amazon S3 destination.
*)destination_identifier : s3_uri;The Amazon S3 URI where query results are delivered. Must be a valid S3 URI format.
*)}Configuration for Amazon S3 destination where scheduled query results are delivered.
type nonrec destination_configuration = {s3_configuration : s3_configuration;Configuration for delivering query results to Amazon S3.
*)}Configuration for where to deliver scheduled query results. Specifies the destination type and associated settings for result delivery.
type nonrec timestamp = Smaws_Lib.CoreTypes.Int64.ttype nonrec update_scheduled_query_response = {last_updated_time : timestamp option;The timestamp when the scheduled query was last updated.
*)creation_time : timestamp option;The timestamp when the scheduled query was originally created.
*)execution_role_arn : role_arn option;The execution role ARN of the updated scheduled query.
*)schedule_end_time : timestamp option;The end time of the updated scheduled query.
*)schedule_start_time : timestamp option;The start time of the updated scheduled query.
*)last_execution_status : execution_status option;The status of the most recent execution of the updated scheduled query.
*)last_triggered_time : timestamp option;The timestamp when the updated scheduled query was last executed.
*)schedule_type : schedule_type option;The schedule type of the updated scheduled query.
*)state : scheduled_query_state option;The state of the updated scheduled query.
*)destination_configuration : destination_configuration option;The destination configuration of the updated scheduled query.
*)end_time_offset : end_time_offset option;The end time offset in seconds of the updated scheduled query.
*)start_time_offset : start_time_offset option;The time offset of the updated scheduled query.
*)timezone : schedule_timezone option;The timezone of the updated scheduled query.
*)schedule_expression : schedule_expression option;The cron expression of the updated scheduled query.
*)log_group_identifiers : scheduled_query_log_group_identifiers option;The log groups queried by the updated scheduled query.
*)query_string : query_string option;The query string of the updated scheduled query.
*)query_language : query_language option;The query language of the updated scheduled query.
*)description : scheduled_query_description option;The description of the updated scheduled query.
*)name : scheduled_query_name option;The name of the updated scheduled query.
*)scheduled_query_arn : arn option;The ARN of the updated scheduled query.
*)}type nonrec update_scheduled_query_request = {state : scheduled_query_state option;The updated state of the scheduled query.
*)execution_role_arn : role_arn;The updated ARN of the IAM role that grants permissions to execute the query and deliver results.
*)schedule_end_time : timestamp option;The updated end time for the scheduled query in Unix epoch format.
*)schedule_start_time : timestamp option;The updated start time for the scheduled query in Unix epoch format.
*)destination_configuration : destination_configuration option;The updated configuration for where to deliver query results.
*)end_time_offset : end_time_offset option;The updated time offset in seconds that defines the end of the lookback period for the query.
*)start_time_offset : start_time_offset option;The updated time offset in seconds that defines the lookback period for the query.
*)timezone : schedule_timezone option;The updated timezone for evaluating the schedule expression.
*)schedule_expression : schedule_expression;The updated cron expression that defines when the scheduled query runs.
*)log_group_identifiers : scheduled_query_log_group_identifiers option;The updated array of log group names or ARNs to query.
*)query_string : query_string;The updated query string to execute.
*)query_language : query_language;The updated query language for the scheduled query.
*)description : scheduled_query_description option;An updated description for the scheduled query.
*)identifier : scheduled_query_identifier;The ARN or name of the scheduled query to update.
*)}The request was throttled because of quota limits.
The specified resource does not exist.
An internal server error occurred while processing the request. This exception is returned when the service encounters an unexpected condition that prevents it from fulfilling the request.
This operation attempted to create a resource that already exists.
You don't have sufficient permissions to perform this action.
type nonrec update_lookup_table_request = {kms_key_id : kms_key_id option;The ARN of the KMS key to use to encrypt the lookup table data. You can use this parameter to add, update, or remove the KMS key. To remove the KMS key and use an Amazon Web Services-owned key instead, specify an empty string.
*)table_body : table_body;The new CSV content to replace the existing data. The first row must be a header row with column names. The content must use UTF-8 encoding and not exceed 10 MB.
*)description : lookup_table_description option;An updated description of the lookup table.
*)lookup_table_arn : arn;The ARN of the lookup table to update.
*)}The service cannot complete the request.
A parameter is specified incorrectly.
type nonrec anomaly_visibility_time = Smaws_Lib.CoreTypes.Int64.ttype nonrec update_log_anomaly_detector_request = {enabled : boolean_;Use this parameter to pause or restart the anomaly detector.
*)anomaly_visibility_time : anomaly_visibility_time option;The number of days to use as the life cycle of anomalies. After this time, anomalies are automatically baselined and the anomaly detector model will treat new occurrences of similar event as normal. Therefore, if you do not correct the cause of an anomaly during this time, it will be considered normal going forward and will not be detected.
*)filter_pattern : filter_pattern option;evaluation_frequency : evaluation_frequency option;Specifies how often the anomaly detector runs and look for anomalies. Set this value according to the frequency that the log group receives new logs. For example, if the log group receives new log events every 10 minutes, then setting evaluationFrequency to FIFTEEN_MIN might be appropriate.
anomaly_detector_arn : anomaly_detector_arn;The ARN of the anomaly detector that you want to update.
*)}Multiple concurrent requests to update the same resource were in conflict.
type nonrec record_fields = field_header listtype nonrec s3_delivery_configuration = {enable_hive_compatible_path : boolean_ option;This parameter causes the S3 objects that contain delivered logs to use a prefix structure that allows for integration with Apache Hive.
*)suffix_path : delivery_suffix_path option;This string allows re-configuring the S3 object prefix to contain either static or variable sections. The valid variables to use in the suffix path will vary by each log source. To find the values supported for the suffix path for each log source, use the DescribeConfigurationTemplates operation and check the allowedSuffixPathFields field in the response.
}This structure contains delivery configurations that apply only when the delivery destination resource is an S3 bucket.
type nonrec update_delivery_configuration_request = {s3_delivery_configuration : s3_delivery_configuration option;This structure contains parameters that are valid only when the delivery's delivery destination is an S3 bucket.
*)field_delimiter : field_delimiter option;The field delimiter to use between record fields when the final output format of a delivery is in Plain, W3C, or Raw format.
record_fields : record_fields option;The list of record fields to be delivered to the destination, in order. If the delivery's log source has mandatory fields, they must be included in this list.
*)id : delivery_id;The ID of the delivery to be updated by this request.
*)}type nonrec suppression_period = {suppression_unit : suppression_unit option;Specifies whether the value of value is in seconds, minutes, or hours.
value : integer option;Specifies the number of seconds, minutes or hours to suppress this anomaly. There is no maximum.
*)}If you are suppressing an anomaly temporariliy, this structure defines how long the suppression period is to be.
type nonrec update_anomaly_request = {baseline : baseline option;Set this to true to prevent CloudWatch Logs from displaying this behavior as an anomaly in the future. The behavior is then treated as baseline behavior. However, if similar but more severe occurrences of this behavior occur in the future, those will still be reported as anomalies.
The default is false
suppression_period : suppression_period option;If you are temporarily suppressing an anomaly or pattern, use this structure to specify how long the suppression is to last.
*)suppression_type : suppression_type option;Use this to specify whether the suppression to be temporary or infinite. If you specify LIMITED, you must also specify a suppressionPeriod. If you specify INFINITE, any value for suppressionPeriod is ignored.
anomaly_detector_arn : anomaly_detector_arn;The ARN of the anomaly detector that this operation is to act on.
*)pattern_id : pattern_id option;If you are suppressing or unsuppressing an pattern, specify its unique ID here. You can find pattern IDs by using the ListAnomalies operation.
*)anomaly_id : anomaly_id option;If you are suppressing or unsuppressing an anomaly, specify its unique ID here. You can find anomaly IDs by using the ListAnomalies operation.
*)}type nonrec tag_key_list = tag_key listtype nonrec untag_resource_request = {tag_keys : tag_key_list;The list of tag keys to remove from the resource.
*)resource_arn : amazon_resource_name;The ARN of the CloudWatch Logs resource that you're removing tags from.
The ARN format of a log group is
arn:aws:logs:{i Region}:{i account-id}:log-group:{i log-group-name} The ARN format of a destination is
arn:aws:logs:{i Region}:{i account-id}:destination:{i destination-name} For more information about ARN format, see CloudWatch Logs resources and operations.
*)}type nonrec tag_list = tag_key listtype nonrec untag_log_group_request = {log_group_name : log_group_name;The name of the log group.
*)}The most likely cause is an Amazon Web Services access key ID or secret key that's not valid.
type nonrec type_converter_entry = {type_ : type_;The type to convert the field value to. Valid values are integer, double, string and boolean.
key : key;The key with the value that is to be converted to a different type.
*)}This object defines one value type that will be converted using the typeConverter processor.
type nonrec type_converter_entries = type_converter_entry listtype nonrec type_converter = {entries : type_converter_entries;An array of TypeConverterEntry objects, where each object contains the information about one field to change the type of.
}Use this processor to convert a value type associated with the specified key to the specified type. It's a casting processor that changes the types of the specified fields. Values can be converted into one of the following datatypes: integer, double, string and boolean.
For more information about this processor including examples, see trimString in the CloudWatch Logs User Guide.
type nonrec trim_string_with_keys = with_key listtype nonrec trim_string = {with_keys : trim_string_with_keys;The array containing the keys of the fields to trim.
*)}Use this processor to remove leading and trailing whitespace.
For more information about this processor including examples, see trimString in the CloudWatch Logs User Guide.
type nonrec scheduled_query_destination = {error_message : string_ option;Error message if destination processing failed.
*)processed_identifier : string_ option;The identifier of the processed result at the destination.
*)status : action_status option;The processing status of the destination delivery.
*)destination_identifier : string_ option;The identifier for the destination where results are delivered.
*)destination_type : scheduled_query_destination_type option;The type of destination for query results.
*)}Information about a destination where scheduled query results are processed, including processing status and any error messages.
type nonrec scheduled_query_destination_list = scheduled_query_destination listtype nonrec trigger_history_record = {destinations : scheduled_query_destination_list option;Information about destination processing for this query execution.
*)error_message : string_ option;Error message if the query execution failed.
*)triggered_timestamp : timestamp option;The timestamp when the scheduled query execution was triggered.
*)execution_status : execution_status option;The execution status of the scheduled query run.
*)query_id : query_id option;The unique identifier for this query execution.
*)}A record of a scheduled query execution, including execution status, timestamp, and destination processing results.
type nonrec trigger_history_record_list = trigger_history_record listtype nonrec event_number = Smaws_Lib.CoreTypes.Int64.ttype nonrec transformed_log_record = {transformed_event_message : transformed_event_message option;The log event message after being transformed.
*)event_message : event_message option;The original log event message before it was transformed.
*)event_number : event_number option;The event number.
*)}This structure contains information for one log event that has been processed by a log transformer.
type nonrec transformed_logs = transformed_log_record listtype nonrec token_value = Smaws_Lib.CoreTypes.Int64.ttype nonrec test_transformer_response = {transformed_logs : transformed_logs option;An array where each member of the array includes both the original version and the transformed version of one of the log events that you input.
*)}type nonrec add_key_entry = {overwrite_if_exists : overwrite_if_exists option;Specifies whether to overwrite the value if the key already exists in the log event. If you omit this, the default is false.
value : add_key_value;The value of the new entry to be added to the log event
*)key : key;The key of the new entry to be added to the log event
*)}This object defines one key that will be added with the addKeys processor.
type nonrec add_key_entries = add_key_entry listtype nonrec add_keys = {entries : add_key_entries;An array of objects, where each object contains the information about one key to add to the log event.
*)}This processor adds new key-value pairs to the log event.
For more information about this processor including examples, see addKeys in the CloudWatch Logs User Guide.
type nonrec copy_value_entry = {overwrite_if_exists : overwrite_if_exists option;Specifies whether to overwrite the value if the destination key already exists. If you omit this, the default is false.
target : target;The key of the field to copy the value to.
*)source : source;The key to copy.
*)}This object defines one value to be copied with the copyValue processor.
type nonrec copy_value_entries = copy_value_entry listtype nonrec copy_value = {entries : copy_value_entries;An array of CopyValueEntry objects, where each object contains the information about one field value to copy.
}This processor copies values within a log event. You can also use this processor to add metadata to log events by copying the values of the following metadata keys into the log events: @logGroupName, @logGroupStream, @accountId, @regionName.
For more information about this processor including examples, see copyValue in the CloudWatch Logs User Guide.
type nonrec columns = column listtype nonrec cs_v = {destination : destination_field option;The path to the parent field to put transformed key value pairs under. If you omit this value, the key value pairs will be placed under the root node.
*)source : source option;The path to the field in the log event that has the comma separated values to be parsed. If you omit this value, the whole log message is processed.
*)columns : columns option;An array of names to use for the columns in the transformed log event.
If you omit this, default column names ([column_1, column_2 ...]) are used.
delimiter : delimiter option;The character used to separate each column in the original comma-separated value log event. If you omit this, the processor looks for the comma , character as the delimiter.
quote_character : quote_character option;The character used used as a text qualifier for a single column of data. If you omit this, the double quotation mark " character is used.
}The CSV processor parses comma-separated values (CSV) from the log events into columns.
For more information about this processor including examples, see csv in the CloudWatch Logs User Guide.
type nonrec match_patterns = match_pattern listtype nonrec date_time_converter = {locale : locale option;The locale of the source field. If you omit this, the default of locale.ROOT is used.
target_timezone : target_timezone option;The time zone of the target field. If you omit this, the default used is the UTC zone.
*)source_timezone : source_timezone option;The time zone of the source field. If you omit this, the default used is the UTC zone.
*)match_patterns : match_patterns;A list of patterns to match against the source field.
target_format : target_format option;The datetime format to use for the converted data in the target field.
If you omit this, the default of yyyy-MM-dd'T'HH:mm:ss.SSS'Z is used.
target : target;The JSON field to store the result in.
*)source : source;The key to apply the date conversion to.
*)}This processor converts a datetime string into a format that you specify.
For more information about this processor including examples, see datetimeConverter in the CloudWatch Logs User Guide.
type nonrec delete_with_keys = with_key listThis processor deletes entries from a log event. These entries are key-value pairs.
For more information about this processor including examples, see deleteKeys in the CloudWatch Logs User Guide.
type nonrec grok = {match_ : grok_match;The grok pattern to match against the log event. For a list of supported grok patterns, see Supported grok patterns.
*)source : source option;The path to the field in the log event that you want to parse. If you omit this value, the whole log message is parsed.
*)}This processor uses pattern matching to parse and structure unstructured data. This processor can also extract fields from log messages.
For more information about this processor including examples, see grok in the CloudWatch Logs User Guide.
type nonrec list_to_map = {flattened_element : flattened_element option;If you set flatten to true, use flattenedElement to specify which element, first or last, to keep.
You must specify this parameter if flatten is true
flatten : flatten option;A Boolean value to indicate whether the list will be flattened into single items. Specify true to flatten the list. The default is false
target : target option;The key of the field that will hold the generated map
*)value_key : value_key option;If this is specified, the values that you specify in this parameter will be extracted from the source objects and put into the values of the generated map. Otherwise, original objects in the source list will be put into the values of the generated map.
key : key;The key of the field to be extracted as keys in the generated map
*)source : source;The key in the log event that has a list of objects that will be converted to a map.
*)}This processor takes a list of objects that contain key fields, and converts them into a map of target keys.
For more information about this processor including examples, see listToMap in the CloudWatch Logs User Guide.
type nonrec lower_case_string_with_keys = with_key listtype nonrec lower_case_string = {with_keys : lower_case_string_with_keys;The array caontaining the keys of the fields to convert to lowercase.
*)}This processor converts a string to lowercase.
For more information about this processor including examples, see lowerCaseString in the CloudWatch Logs User Guide.
type nonrec move_key_entry = {overwrite_if_exists : overwrite_if_exists option;Specifies whether to overwrite the value if the destination key already exists. If you omit this, the default is false.
target : target;The key to move to.
*)source : source;The key to move.
*)}This object defines one key that will be moved with the moveKey processor.
type nonrec move_key_entries = move_key_entry listtype nonrec move_keys = {entries : move_key_entries;An array of objects, where each object contains the information about one key to move.
*)}This processor moves a key from one field to another. The original key is deleted.
For more information about this processor including examples, see moveKeys in the CloudWatch Logs User Guide.
type nonrec parse_cloudfront = {source : source option;Omit this parameter and the whole log message will be processed by this processor. No other value than @message is allowed for source.
}This processor parses CloudFront vended logs, extract fields, and convert them into JSON format. Encoded field values are decoded. Values that are integers and doubles are treated as such. For more information about this processor including examples, see parseCloudfront
For more information about CloudFront log format, see Configure and use standard logs (access logs).
If you use this processor, it must be the first processor in your transformer.
type nonrec parse_jso_n = {destination : destination_field option;The location to put the parsed key value pair into. If you omit this parameter, it is placed under the root node.
*)source : source option;Path to the field in the log event that will be parsed. Use dot notation to access child fields. For example, store.book
}This processor parses log events that are in JSON format. It can extract JSON key-value pairs and place them under a destination that you specify.
Additionally, because you must have at least one parse-type processor in a transformer, you can use ParseJSON as that processor for JSON-format logs, so that you can also apply other processors, such as mutate processors, to these logs.
For more information about this processor including examples, see parseJSON in the CloudWatch Logs User Guide.
type nonrec parse_key_value = {overwrite_if_exists : overwrite_if_exists option;Specifies whether to overwrite the value if the destination key already exists. If you omit this, the default is false.
non_match_value : non_match_value option;A value to insert into the value field in the result, when a key-value pair is not successfully split.
*)key_prefix : key_prefix option;If you want to add a prefix to all transformed keys, specify it here.
*)key_value_delimiter : key_value_delimiter option;The delimiter string to use between the key and value in each pair in the transformed log event.
If you omit this, the equal = character is used.
field_delimiter : parser_field_delimiter option;The field delimiter string that is used between key-value pairs in the original log events. If you omit this, the ampersand & character is used.
destination : destination_field option;The destination field to put the extracted key-value pairs into
*)source : source option;Path to the field in the log event that will be parsed. Use dot notation to access child fields. For example, store.book
}This processor parses a specified field in the original log event into key-value pairs.
For more information about this processor including examples, see parseKeyValue in the CloudWatch Logs User Guide.
type nonrec parse_route53 = {source : source option;Omit this parameter and the whole log message will be processed by this processor. No other value than @message is allowed for source.
}Use this processor to parse Route 53 vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message. For more information about this processor including examples, see parseRoute53.
If you use this processor, it must be the first processor in your transformer.
type nonrec parse_to_ocs_f = {mapping_version : mapping_version option;The version of the OCSF mapping to use for parsing log data.
*)ocsf_version : ocsf_version;Specify which version of the OCSF schema to use for the transformed log events.
*)event_source : event_source;Specify the service or process that produces the log events that will be converted with this processor.
*)source : source option;The path to the field in the log event that you want to parse. If you omit this value, the whole log message is parsed.
*)}This processor converts logs into Open Cybersecurity Schema Framework (OCSF) events.
For more information about this processor including examples, see parseToOCSF in the CloudWatch Logs User Guide.
type nonrec parse_postgres = {source : source option;Omit this parameter and the whole log message will be processed by this processor. No other value than @message is allowed for source.
}Use this processor to parse RDS for PostgreSQL vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message. For more information about this processor including examples, see parsePostGres.
For more information about RDS for PostgreSQL log format, see RDS for PostgreSQL database log filesTCP flag sequence.
If you use this processor, it must be the first processor in your transformer.
type nonrec parse_vp_c = {source : source option;Omit this parameter and the whole log message will be processed by this processor. No other value than @message is allowed for source.
}Use this processor to parse Amazon VPC vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message.
This processor doesn't support custom log formats, such as NAT gateway logs. For more information about custom log formats in Amazon VPC, see parseVPC For more information about this processor including examples, see parseVPC.
If you use this processor, it must be the first processor in your transformer.
type nonrec parse_wa_f = {source : source option;Omit this parameter and the whole log message will be processed by this processor. No other value than @message is allowed for source.
}Use this processor to parse WAF vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message. For more information about this processor including examples, see parseWAF.
For more information about WAF log format, see Log examples for web ACL traffic.
If you use this processor, it must be the first processor in your transformer.
type nonrec rename_key_entry = {overwrite_if_exists : overwrite_if_exists option;Specifies whether to overwrite the existing value if the destination key already exists. The default is false
rename_to : rename_to;The string to use for the new key name
*)key : key;The key to rename
*)}This object defines one key that will be renamed with the renameKey processor.
type nonrec rename_key_entries = rename_key_entry listtype nonrec rename_keys = {entries : rename_key_entries;An array of RenameKeyEntry objects, where each object contains the information about a single key to rename.
}Use this processor to rename keys in a log event.
For more information about this processor including examples, see renameKeys in the CloudWatch Logs User Guide.
type nonrec split_string_entry = {delimiter : split_string_delimiter;The separator characters to split the string entry on.
*)source : source;The key of the field to split.
*)}This object defines one log field that will be split with the splitString processor.
type nonrec split_string_entries = split_string_entry listtype nonrec split_string = {entries : split_string_entries;An array of SplitStringEntry objects, where each object contains the information about one field to split.
}Use this processor to split a field into an array of strings using a delimiting character.
For more information about this processor including examples, see splitString in the CloudWatch Logs User Guide.
type nonrec substitute_string_entry = {to_ : to_key;The string to be substituted for each match of from
from_ : from_key;The regular expression string to be replaced. Special regex characters such as [ and ] must be escaped using \\ when using double quotes and with \ when using single quotes. For more information, see Class Pattern on the Oracle web site.
*)source : source;The key to modify
*)}This object defines one log field key that will be replaced using the substituteString processor.
type nonrec substitute_string_entries = substitute_string_entry listtype nonrec substitute_string = {entries : substitute_string_entries;An array of objects, where each object contains the information about one key to match and replace.
*)}This processor matches a key’s value against a regular expression and replaces all matches with a replacement string.
For more information about this processor including examples, see substituteString in the CloudWatch Logs User Guide.
type nonrec processor = {upper_case_string : upper_case_string option;type_converter : type_converter option;trim_string : trim_string option;substitute_string : substitute_string option;split_string : split_string option;rename_keys : rename_keys option;parse_wa_f : parse_wa_f option;Use this parameter to include the parseWAF processor in your transformer.
If you use this processor, it must be the first processor in your transformer.
*)parse_vp_c : parse_vp_c option;Use this parameter to include the parseVPC processor in your transformer.
If you use this processor, it must be the first processor in your transformer.
*)parse_postgres : parse_postgres option;Use this parameter to include the parsePostGres processor in your transformer.
If you use this processor, it must be the first processor in your transformer.
*)parse_to_ocs_f : parse_to_ocs_f option;Use this parameter to convert logs into Open Cybersecurity Schema (OCSF) format.
*)parse_route53 : parse_route53 option;Use this parameter to include the parseRoute53 processor in your transformer.
If you use this processor, it must be the first processor in your transformer.
*)parse_key_value : parse_key_value option;parse_jso_n : parse_jso_n option;parse_cloudfront : parse_cloudfront option;Use this parameter to include the parseCloudfront processor in your transformer.
If you use this processor, it must be the first processor in your transformer.
*)move_keys : move_keys option;lower_case_string : lower_case_string option;list_to_map : list_to_map option;grok : grok option;delete_keys : delete_keys option;date_time_converter : date_time_converter option;csv : cs_v option;copy_value : copy_value option;add_keys : add_keys option;}This structure contains the information about one processor in a log transformer.
type nonrec processors = processor listtype nonrec test_event_messages = event_message listtype nonrec test_transformer_request = {log_event_messages : test_event_messages;An array of the raw log events that you want to use to test this transformer.
*)transformer_config : processors;This structure contains the configuration of this log transformer that you want to test. A log transformer is an array of processors, where each processor applies one type of transformation to the log events that are ingested.
*)}The operation is not valid on the specified resource.
type nonrec metric_filter_match_record = {extracted_values : extracted_values option;The values extracted from the event data by the filter.
*)event_message : event_message option;The raw event data.
*)event_number : event_number option;The event number.
*)}Represents a matched event.
type nonrec metric_filter_matches = metric_filter_match_record listtype nonrec test_metric_filter_response = {matches : metric_filter_matches option;The matched events.
*)}type nonrec test_metric_filter_request = {log_event_messages : test_event_messages;The log event messages to test.
*)filter_pattern : filter_pattern;}type nonrec tag_resource_request = {resource_arn : amazon_resource_name;The ARN of the resource that you're adding tags to.
The ARN format of a log group is
arn:aws:logs:{i Region}:{i account-id}:log-group:{i log-group-name} The ARN format of a destination is
arn:aws:logs:{i Region}:{i account-id}:destination:{i destination-name} For more information about ARN format, see CloudWatch Logs resources and operations.
*)}type nonrec tag_log_group_request = {log_group_name : log_group_name;The name of the log group.
*)}type nonrec tag_filter_values = tag_filter_value listtype nonrec tag_filter = {values : tag_filter_values option;An optional list of tag values to filter on.
* for wildcard matching. For example, prod* matches values that start with prod.! as a prefix for negation. For example, !prod matches values that are not prod.key : tag_filter_key;The tag key to filter on.
*)}A tag filter that specifies a tag key and optional tag values for filtering log groups by tags.
type nonrec tag_filters = tag_filter listtype nonrec table_fields = string_ listtype nonrec syslog_configuration = {created_at : timestamp option;The time when the syslog configuration was created, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
vpc_endpoint_id : vpc_endpoint_id option;The ID of the VPC endpoint used for syslog ingestion.
*)source_type : syslog_source_type option;The source type for the syslog configuration.
*)log_group_arn : log_group_arn option;The ARN of the log group associated with this syslog configuration.
*)}Contains information about a syslog configuration associated with a log group.
type nonrec syslog_configurations = syslog_configuration listThe method used to distribute log data to the destination, which can be either random or grouped by log stream.
type nonrec emit_system_fields = system_field listtype nonrec subscription_filter = {emit_system_fields : emit_system_fields option;The list of system fields that are included in the log events sent to the subscription destination. Returns the emitSystemFields value if it was specified when the subscription filter was created.
field_selection_criteria : field_selection_criteria option;The filter expression that specifies which log events are processed by this subscription filter based on system fields. Returns the fieldSelectionCriteria value if it was specified when the subscription filter was created.
creation_time : timestamp option;The creation time of the subscription filter, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
apply_on_transformed_logs : apply_on_transformed_logs option;This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see PutTransformer.
If this value is true, the subscription filter is applied on the transformed version of the log events instead of the original ingested log events.
distribution : distribution option;role_arn : role_arn option;destination_arn : destination_arn option;The Amazon Resource Name (ARN) of the destination.
*)filter_pattern : filter_pattern option;log_group_name : log_group_name option;The name of the log group.
*)filter_name : filter_name option;The name of the subscription filter.
*)}Represents a subscription filter.
type nonrec subscription_filters = subscription_filter listtype nonrec stored_bytes = Smaws_Lib.CoreTypes.Int64.ttype nonrec stop_query_response = {success : success option;This is true if the query was stopped by the StopQuery operation.
}type nonrec stop_query_request = {query_id : query_id;The ID number of the query to stop. To find this ID number, use DescribeQueries.
}type nonrec log_group_names = log_group_name listtype nonrec log_group_identifiers = log_group_identifier listtype nonrec start_query_request = {limit : events_limit_start_query option;The maximum number of log events to return from the query. The maximum limit is 100,000. The maximum events returned in a single GetQueryResults API call is 10,000 log events per request. You can retrieve up to 100,000 log event results from a query by paginating with the nextToken. 100,000 limit is only supported for Logs Insights QL and is currently not supported for PPL and SQL query languages.
query_string : query_string;end_time : timestamp;The end of the time range to query. The range is inclusive, so the specified end time is included in the query. Specified as epoch time, the number of seconds since January 1, 1970, 00:00:00 UTC.
start_time : timestamp;The beginning of the time range to query. The range is inclusive, so the specified start time is included in the query. Specified as epoch time, the number of seconds since January 1, 1970, 00:00:00 UTC.
log_group_identifiers : log_group_identifiers option;The list of log groups to query. You can include up to 50 log groups.
You can specify them by the log group name or ARN. If a log group that you're querying is in a source account and you're using a monitoring account, you must specify the ARN of the log group here. The query definition must also be defined in the monitoring account.
If you specify an ARN, use the format arn:aws:logs:region:account-id:log-group:log_group_name Don't include an * at the end.
A StartQuery operation must include exactly one of the following parameters: logGroupName, logGroupNames, or logGroupIdentifiers. The exception is queries using the OpenSearch Service SQL query language, where you specify the log group names inside the querystring instead of here.
log_group_names : log_group_names option;The list of log groups to be queried. You can include up to 50 log groups.
A StartQuery operation must include exactly one of the following parameters: logGroupName, logGroupNames, or logGroupIdentifiers. The exception is queries using the OpenSearch Service SQL query language, where you specify the log group names inside the querystring instead of here.
log_group_name : log_group_name option;The log group on which to perform the query.
A StartQuery operation must include exactly one of the following parameters: logGroupName, logGroupNames, or logGroupIdentifiers. The exception is queries using the OpenSearch Service SQL query language, where you specify the log group names inside the querystring instead of here.
query_language : query_language option;Specify the query language to use for this query. The options are Logs Insights QL, OpenSearch PPL, and OpenSearch SQL. For more information about the query languages that CloudWatch Logs supports, see Supported query languages.
*)}type nonrec query_compile_error_location = {end_char_offset : query_char_offset option;Reserved.
*)start_char_offset : query_char_offset option;Reserved.
*)}Reserved.
type nonrec query_compile_error = {message : message option;Reserved.
*)location : query_compile_error_location option;Reserved.
*)}Reserved.
type nonrec malformed_query_exception = {message : message option;query_compile_error : query_compile_error option;}The query string is not valid. Details about this error are displayed in a QueryCompileError object. For more information, see QueryCompileError.
For more information about valid query syntax, see CloudWatch Logs Insights Query Syntax.
You have reached the maximum number of resources that can be created.
type nonrec start_live_tail_log_group_identifiers = log_group_identifier listtype nonrec input_log_stream_names = log_stream_name listtype nonrec live_tail_session_start = {log_event_filter_pattern : filter_pattern option;An optional pattern to filter the results to include only log events that match the pattern. For example, a filter pattern of error 404 displays only log events that include both error and 404.
For more information about filter pattern syntax, see Filter and Pattern Syntax.
*)log_stream_name_prefixes : input_log_stream_names option;If your StartLiveTail operation request included a logStreamNamePrefixes parameter that filtered the session to only include log streams that have names that start with certain prefixes, these prefixes are listed here.
log_stream_names : input_log_stream_names option;If your StartLiveTail operation request included a logStreamNames parameter that filtered the session to only include certain log streams, these streams are listed here.
log_group_identifiers : start_live_tail_log_group_identifiers option;An array of the names and ARNs of the log groups included in this Live Tail session.
*)session_id : session_id option;The unique ID generated by CloudWatch Logs to identify this Live Tail session.
*)request_id : request_id option;The unique ID generated by CloudWatch Logs to identify this Live Tail session request.
*)}This object contains information about this Live Tail session, including the log groups included and the log stream filters, if any.
type nonrec live_tail_session_metadata = {sampled : is_sampled option;If this is true, then more than 500 log events matched the request for this update, and the sessionResults includes a sample of 500 of those events.
If this is false, then 500 or fewer log events matched the request for this update, so no sampling was necessary. In this case, the sessionResults array includes all log events that matched your request during this time.
}This object contains the metadata for one LiveTailSessionUpdate structure. It indicates whether that update includes only a sample of 500 log events out of a larger number of ingested log events, or if it contains all of the matching log events ingested during that second of time.
type nonrec live_tail_session_log_event = {ingestion_time : timestamp option;The timestamp specifying when this log event was ingested into the log group.
*)timestamp : timestamp option;The timestamp specifying when this log event was created.
*)message : event_message option;The log event message text.
*)log_group_identifier : log_group_identifier option;The name or ARN of the log group that ingested this log event.
*)log_stream_name : log_stream_name option;The name of the log stream that ingested this log event.
*)}This object contains the information for one log event returned in a Live Tail stream.
type nonrec live_tail_session_results = live_tail_session_log_event listtype nonrec live_tail_session_update = {session_results : live_tail_session_results option;An array, where each member of the array includes the information for one log event in the Live Tail session.
A sessionResults array can include as many as 500 log events. If the number of log events matching the request exceeds 500 per second, the log events are sampled down to 500 log events to be included in each sessionUpdate structure.
session_metadata : live_tail_session_metadata option;This object contains the session metadata for a Live Tail session.
*)}This object contains the log events and metadata for a Live Tail session.
This exception is returned in a Live Tail stream when the Live Tail session times out. Live Tail sessions time out after three hours.
This exception is returned if an unknown error occurs during a Live Tail session.
type nonrec start_live_tail_response_stream = | SessionStreamingException of session_streaming_exceptionThis exception is returned if an unknown error occurs.
*)| SessionTimeoutException of session_timeout_exceptionThis exception is returned in the stream when the Live Tail session times out. Live Tail sessions time out after three hours.
*)| SessionUpdate of live_tail_session_updateThis object contains the log events and session metadata.
*)| SessionStart of live_tail_session_startThis object contains information about this Live Tail session, including the log groups included and the log stream filters, if any.
*)This object includes the stream returned by your StartLiveTail request.
type nonrec start_live_tail_response = {response_stream : start_live_tail_response_stream option;An object that includes the stream returned by your request. It can include both log events and exceptions.
*)}type nonrec start_live_tail_request = {log_event_filter_pattern : filter_pattern option;An optional pattern to use to filter the results to include only log events that match the pattern. For example, a filter pattern of error 404 causes only log events that include both error and 404 to be included in the Live Tail stream.
Regular expression filter patterns are supported.
For more information about filter pattern syntax, see Filter and Pattern Syntax.
*)log_stream_name_prefixes : input_log_stream_names option;If you specify this parameter, then only log events in the log streams that have names that start with the prefixes that you specify here are included in the Live Tail session.
If you specify this field, you can't also specify the logStreamNames field.
You can specify this parameter only if you specify only one log group in logGroupIdentifiers.
log_stream_names : input_log_stream_names option;If you specify this parameter, then only log events in the log streams that you specify here are included in the Live Tail session.
If you specify this field, you can't also specify the logStreamNamePrefixes field.
You can specify this parameter only if you specify only one log group in logGroupIdentifiers.
log_group_identifiers : start_live_tail_log_group_identifiers;An array where each item in the array is a log group to include in the Live Tail session.
Specify each log group by its ARN.
If you specify an ARN, the ARN can't end with an asterisk (*).
You can include up to 10 log groups.
*)}type nonrec standard_unit = | None_| CountSecond| TerabitsSecond| GigabitsSecond| MegabitsSecond| KilobitsSecond| BitsSecond| TerabytesSecond| GigabytesSecond| MegabytesSecond| KilobytesSecond| BytesSecond| Count| Percent| Terabits| Gigabits| Megabits| Kilobits| Bits| Terabytes| Gigabytes| Megabytes| Kilobytes| Bytes| Milliseconds| Microseconds| SecondsThis request exceeds a service quota.
type nonrec searched_log_stream = {searched_completely : log_stream_searched_completely option;Indicates whether all the events in this log stream were searched.
*)log_stream_name : log_stream_name option;The name of the log stream.
*)}Represents the search status of a log stream.
type nonrec searched_log_streams = searched_log_stream listtype nonrec scheduled_query_summary = {last_updated_time : timestamp option;The timestamp when the scheduled query was last updated.
*)creation_time : timestamp option;The timestamp when the scheduled query was created.
*)destination_configuration : destination_configuration option;Configuration for where query results are delivered.
*)timezone : schedule_timezone option;The timezone used for evaluating the schedule expression.
*)schedule_expression : schedule_expression option;The cron expression that defines when the scheduled query runs.
*)last_execution_status : execution_status option;The status of the most recent execution.
*)last_triggered_time : timestamp option;The timestamp when the scheduled query was last executed.
*)schedule_type : schedule_type option;The schedule type of the scheduled query. Valid values are CUSTOMER_MANAGED and AWS_MANAGED.
state : scheduled_query_state option;The current state of the scheduled query.
*)name : scheduled_query_name option;The name of the scheduled query.
*)scheduled_query_arn : arn option;The ARN of the scheduled query.
*)}Summary information about a scheduled query, including basic configuration and execution status.
type nonrec scheduled_query_summary_list = scheduled_query_summary listtype nonrec s3_tables_integration = {datasource_type : s3_tables_datasource_type option;The type of the S3 Tables datasource.
*)datasource_name : s3_tables_datasource_name option;The name of the S3 Tables datasource.
*)}Contains information about the S3 Tables integration configuration for a configuration template.
type nonrec data_source = {type_ : data_source_type option;The type of the data source.
*)name : data_source_name;The name of the data source.
*)}Represents a data source that categorizes logs by originating service and log type, providing service-based organization complementing traditional log groups.
type nonrec s3_table_integration_source = {parent_source_identifier : s3_table_integration_source_identifier option;The identifier of the parent data source for this association.
*)created_time_stamp : timestamp option;The timestamp when the data source association was created.
*)status_reason : s3_table_integration_source_status_reason option;Additional information about the status of the data source association.
*)status : s3_table_integration_source_status option;The current status of the data source association.
*)data_source : data_source option;The data source associated with the S3 Table Integration.
*)identifier : s3_table_integration_source_identifier option;The unique identifier for this data source association.
*)}Represents a data source association with an S3 Table Integration, including its status and metadata.
type nonrec s3_table_integration_sources = s3_table_integration_source listContains one field from one log event returned by a CloudWatch Logs Insights query, along with the value of that field.
For more information about the fields that are generated by CloudWatch logs, see Supported Logs and Discovered Fields.
type nonrec result_rows = result_field listtype nonrec resource_types = resource_type listtype nonrec resource_policy = {revision_id : expected_revision_id option;The revision ID of the resource policy. Only populated for resource-scoped policies.
*)resource_arn : arn option;The ARN of the CloudWatch Logs resource to which the resource policy is attached. Only populated for resource-scoped policies.
*)policy_scope : policy_scope option;Specifies scope of the resource policy. Valid values are ACCOUNT or RESOURCE.
*)last_updated_time : timestamp option;Timestamp showing when this policy was last updated, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
policy_document : policy_document option;The details of the policy.
*)policy_name : policy_name option;The name of the resource policy.
*)}A policy enabling one or more entities to put logs to a log group in this account.
type nonrec resource_policies = resource_policy listtype nonrec dashboard_viewer_principals = arn listtype nonrec open_search_resource_config = {retention_days : collection_retention_days;Specify how many days that you want the data derived by OpenSearch Service to be retained in the index that the dashboard refers to. This also sets the maximum time period that you can choose when viewing data in the dashboard. Choosing a longer time frame will incur additional costs.
*)application_arn : arn option;If you want to use an existing OpenSearch Service application for your integration with OpenSearch Service, specify it here. If you omit this, a new application will be created.
*)dashboard_viewer_principals : dashboard_viewer_principals;Specify the ARNs of IAM roles and IAM users who you want to grant permission to for viewing the dashboards.
In addition to specifying these users here, you must also grant them the CloudWatchOpenSearchDashboardAccess IAM policy. For more information, see IAM policies for users.
*)data_source_role_arn : arn;Specify the ARN of an IAM role that CloudWatch Logs will use to create the integration. This role must have the permissions necessary to access the OpenSearch Service collection to be able to create the dashboards. For more information about the permissions needed, see Permissions that the integration needs in the CloudWatch Logs User Guide.
*)kms_key_arn : arn option;To have the vended dashboard data encrypted with KMS instead of the CloudWatch Logs default encryption method, specify the ARN of the KMS key that you want to use.
*)}This structure contains configuration details about an integration between CloudWatch Logs and OpenSearch Service.
type nonrec resource_config = | OpenSearchResourceConfig of open_search_resource_configThis structure contains configuration details about an integration between CloudWatch Logs and OpenSearch Service.
*)This structure contains configuration details about an integration between CloudWatch Logs and another entity.
type nonrec resource_arns = arn listThe specified resource already exists.
type nonrec rejected_log_events_info = {expired_log_event_end_index : log_event_index option;The expired log events.
*)too_old_log_event_end_index : log_event_index option;The index of the last log event that is too old. This field is exclusive.
*)too_new_log_event_start_index : log_event_index option;The index of the first log event that is too new. This field is inclusive.
*)}Represents the rejected events.
type nonrec rejected_entity_info = {error_type : entity_rejection_error_type;The type of error that caused the rejection of the entity when calling PutLogEvents.
}If an entity is rejected when a PutLogEvents request was made, this includes details about the reason for the rejection.
type nonrec records_count = Smaws_Lib.CoreTypes.Int64.ttype nonrec record_field = {mandatory : boolean_ option;If this is true, the record field must be present in the recordFields parameter provided to a CreateDelivery or UpdateDeliveryConfiguration operation.
name : field_header option;The name to use when specifying this record field in a CreateDelivery or UpdateDeliveryConfiguration operation.
*)}A structure that represents a valid record field header and whether it is mandatory.
type nonrec query_statistics = {log_groups_scanned : stats_value option;The number of log groups that were scanned by this query.
*)estimated_bytes_skipped : stats_value option;An estimate of the number of bytes in the log events that were skipped when processing this query, because the query contained an indexed field. Skipping these entries lowers query costs and improves the query performance time. For more information about field indexes, see PutIndexPolicy.
*)bytes_scanned : stats_value option;The total number of bytes in the log events scanned during the query.
*)estimated_records_skipped : stats_value option;An estimate of the number of log events that were skipped when processing this query, because the query contained an indexed field. Skipping these entries lowers query costs and improves the query performance time. For more information about field indexes, see PutIndexPolicy.
*)records_scanned : stats_value option;The total number of log events scanned during the query.
*)records_matched : stats_value option;The number of log events that matched the query string.
*)}Contains the number of log events scanned by the query, the number of log events that matched the query criteria, and the total number of bytes in the log events that were scanned.
If the query involved log groups that have field index policies, the estimated number of skipped log events and the total bytes of those skipped log events are included. Using field indexes to skip log events in queries reduces scan volume and improves performance. For more information, see Create field indexes to improve query performance and reduce scan volume.
type nonrec query_results = result_rows listtype nonrec query_parameter = {description : query_parameter_description option;A description of the query parameter that explains its purpose or expected values.
*)default_value : query_parameter_default_value option;The default value to use for this query parameter if no value is supplied at execution time.
*)name : query_parameter_name;The name of the query parameter. A query parameter name must start with a letter or underscore, and contain only letters, digits, and underscores.
*)}This structure defines a query parameter for a saved CloudWatch Logs Insights query definition. Query parameters are supported only for Logs Insights QL queries. They are placeholder variables that you can reference in a query string using the {{parameterName}} syntax. Each parameter can include a default value and a description.
type nonrec query_parameter_list = query_parameter listtype nonrec query_duration = Smaws_Lib.CoreTypes.Int64.ttype nonrec query_info = {user_identity : user_identity option;The ARN of the user who ran the query.
*)bytes_scanned : bytes_scanned_value option;The total number of bytes scanned by the query. This indicates the cost associated with the query.
*)query_duration : query_duration option;The duration in milliseconds that the query took to execute.
*)log_group_name : log_group_name option;The name of the log group scanned by this query.
*)create_time : timestamp option;The date and time that this query was created.
*)status : query_status option;The status of this query. Possible values are Cancelled, Complete, Failed, Running, Scheduled, and Unknown.
query_string : query_string option;The query string used in this query.
*)query_id : query_id option;The unique ID number of this query.
*)query_language : query_language option;The query language used for this query. For more information about the query languages that CloudWatch Logs supports, see Supported query languages.
*)}Information about one CloudWatch Logs Insights query that matches the request in a DescribeQueries operation.
type nonrec query_info_list = query_info listtype nonrec query_definition = {parameters : query_parameter_list option;If this query definition contains a list of query parameters that define placeholder variables for the query string, that list appears here.
*)log_group_names : log_group_names option;If this query definition contains a list of log groups that it is limited to, that list appears here.
*)last_modified : timestamp option;The date that the query definition was most recently modified.
*)query_string : query_definition_string option;The query string to use for this definition. For more information, see CloudWatch Logs Insights Query Syntax.
*)name : query_definition_name option;The name of the query definition.
*)query_definition_id : query_id option;The unique ID of the query definition.
*)query_language : query_language option;The query language used for this query. For more information about the query languages that CloudWatch Logs supports, see Supported query languages.
*)}This structure contains details about a saved CloudWatch Logs Insights query definition.
type nonrec query_definition_list = query_definition listtype nonrec put_transformer_request = {transformer_config : processors;This structure contains the configuration of this log transformer. A log transformer is an array of processors, where each processor applies one type of transformation to the log events that are ingested.
*)log_group_identifier : log_group_identifier;Specify either the name or ARN of the log group to create the transformer for.
*)}type nonrec put_syslog_configuration_request = {vpc_endpoint_id : vpc_endpoint_id option;The ID of the VPC endpoint to use for syslog ingestion.
*)log_group_identifier : log_group_identifier;The name or ARN of the log group to associate with the syslog configuration.
*)}type nonrec put_subscription_filter_request = {emit_system_fields : emit_system_fields option;A list of system fields to include in the log events sent to the subscription destination. Valid values are @aws.account and @aws.region. These fields provide source information for centralized log data in the forwarded payload.
field_selection_criteria : field_selection_criteria option;A filter expression that specifies which log events should be processed by this subscription filter based on system fields such as source account and source region. Uses selection criteria syntax with operators like =, !=, AND, OR, IN, NOT IN. Example: @aws.region NOT IN ["cn-north-1"] or @aws.account = "123456789012" AND @aws.region = "us-east-1". Maximum length: 2000 characters.
apply_on_transformed_logs : apply_on_transformed_logs option;This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see PutTransformer.
If the log group uses either a log-group level or account-level transformer, and you specify true, the subscription filter will be applied on the transformed version of the log events instead of the original ingested log events.
distribution : distribution option;The method used to distribute log data to the destination. By default, log data is grouped by log stream, but the grouping can be set to random for a more even distribution. This property is only applicable when the destination is an Amazon Kinesis data stream.
*)role_arn : role_arn option;The ARN of an IAM role that grants CloudWatch Logs permissions to deliver ingested log events to the destination stream. You don't need to provide the ARN when you are working with a logical destination for cross-account delivery.
*)destination_arn : destination_arn;The ARN of the destination to deliver matching log events to. Currently, the supported destinations are:
A logical destination (specified using an ARN) belonging to a different account, for cross-account delivery.
If you're setting up a cross-account subscription, the destination must have an IAM policy associated with it. The IAM policy must allow the sender to send logs to the destination. For more information, see PutDestinationPolicy.
filter_pattern : filter_pattern;A filter pattern for subscribing to a filtered stream of log events.
*)filter_name : filter_name;A name for the subscription filter. If you are updating an existing filter, you must specify the correct name in filterName. To find the name of the filter currently associated with a log group, use DescribeSubscriptionFilters.
log_group_name : log_group_name;The name of the log group.
*)}type nonrec put_retention_policy_request = {retention_in_days : days;log_group_name : log_group_name;The name of the log group.
*)}type nonrec put_resource_policy_response = {revision_id : expected_revision_id option;The revision ID of the created or updated resource policy. Only returned for resource-scoped policies.
*)resource_policy : resource_policy option;The new policy.
*)}type nonrec put_resource_policy_request = {expected_revision_id : expected_revision_id option;The expected revision ID of the resource policy. Required when resourceArn is provided to prevent concurrent modifications. Use null when creating a resource policy for the first time.
resource_arn : arn option;The ARN of the CloudWatch Logs resource to which the resource policy needs to be added or attached. Currently only supports LogGroup ARN.
*)policy_document : policy_document option;Details of the new policy, including the identity of the principal that is enabled to put logs to this account. This is formatted as a JSON string. This parameter is required.
The following example creates a resource policy enabling the Route 53 service to put DNS query logs in to the specified log group. Replace "logArn" with the ARN of your CloudWatch Logs resource, such as a log group or log stream.
CloudWatch Logs also supports aws:SourceArn and aws:SourceAccount condition context keys.
In the example resource policy, you would replace the value of SourceArn with the resource making the call from Route 53 to CloudWatch Logs. You would also replace the value of SourceAccount with the Amazon Web Services account ID making that call.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "Route53LogsToCloudWatchLogs", "Effect": "Allow", "Principal": { "Service": [ "route53.amazonaws.com" ] }, "Action": "logs:PutLogEvents", "Resource": "logArn", "Condition": { "ArnLike": { "aws:SourceArn": "myRoute53ResourceArn" }, "StringEquals": { "aws:SourceAccount": "myAwsAccountId" } } } ] }
policy_name : policy_name option;Name of the new policy. This parameter is required.
*)}type nonrec put_query_definition_response = {query_definition_id : query_id option;The ID of the query definition.
*)}type nonrec put_query_definition_request = {parameters : query_parameter_list option;Use this parameter to include specific query parameters as part of your query definition. Query parameters are supported only for Logs Insights QL queries. Query parameters allow you to use placeholder variables in your query string that are substituted with values at execution time. Use the {{parameterName}} syntax in your query string to reference a parameter.
client_token : client_token option;Used as an idempotency token, to avoid returning an exception if the service receives the same request twice because of a network error.
*)query_string : query_definition_string;The query string to use for this definition. For more information, see CloudWatch Logs Insights Query Syntax.
*)log_group_names : log_group_names option;Use this parameter to include specific log groups as part of your query definition. If your query uses the OpenSearch Service query language, you specify the log group names inside the querystring instead of here.
If you are updating an existing query definition for the Logs Insights QL or OpenSearch Service PPL and you omit this parameter, then the updated definition will contain no log groups.
*)query_definition_id : query_id option;If you are updating a query definition, use this parameter to specify the ID of the query definition that you want to update. You can use DescribeQueryDefinitions to retrieve the IDs of your saved query definitions.
If you are creating a query definition, do not specify this parameter. CloudWatch generates a unique ID for the new query definition and include it in the response to this operation.
*)name : query_definition_name;A name for the query definition. If you are saving numerous query definitions, we recommend that you name them. This way, you can find the ones you want by using the first part of the name as a filter in the queryDefinitionNamePrefix parameter of DescribeQueryDefinitions.
query_language : query_language option;Specify the query language to use for this query. The options are Logs Insights QL, OpenSearch PPL, and OpenSearch SQL. For more information about the query languages that CloudWatch Logs supports, see Supported query languages.
*)}type nonrec dimensions = (dimensions_key * dimensions_value) listtype nonrec metric_transformation = {unit_ : standard_unit option;The unit to assign to the metric. If you omit this, the unit is set as None.
dimensions : dimensions option;The fields to use as dimensions for the metric. One metric filter can include as many as three dimensions.
Metrics extracted from log events are charged as custom metrics. To prevent unexpected high charges, do not specify high-cardinality fields such as IPAddress or requestID as dimensions. Each different value found for a dimension is treated as a separate metric and accrues charges as a separate custom metric.
CloudWatch Logs disables a metric filter if it generates 1000 different name/value pairs for your specified dimensions within a certain amount of time. This helps to prevent accidental high charges.
You can also set up a billing alarm to alert you if your charges are higher than expected. For more information, see Creating a Billing Alarm to Monitor Your Estimated Amazon Web Services Charges.
*)default_value : default_value option;(Optional) The value to emit when a filter pattern does not match a log event. This value can be null.
*)metric_value : metric_value;The value to publish to the CloudWatch metric when a filter pattern matches a log event.
*)metric_namespace : metric_namespace;A custom namespace to contain your metric in CloudWatch. Use namespaces to group together metrics that are similar. For more information, see Namespaces.
*)metric_name : metric_name;The name of the CloudWatch metric.
*)}Indicates how to transform ingested log events to metric data in a CloudWatch metric.
type nonrec metric_transformations = metric_transformation listtype nonrec put_metric_filter_request = {emit_system_field_dimensions : emit_system_fields option;A list of system fields to emit as additional dimensions in the generated metrics. Valid values are @aws.account and @aws.region. These dimensions help identify the source of centralized log data and count toward the total dimension limit for metric filters.
field_selection_criteria : field_selection_criteria option;A filter expression that specifies which log events should be processed by this metric filter based on system fields such as source account and source region. Uses selection criteria syntax with operators like =, !=, AND, OR, IN, NOT IN. Example: @aws.region = "us-east-1" or @aws.account IN ["123456789012", "987654321098"]. Maximum length: 2000 characters.
apply_on_transformed_logs : apply_on_transformed_logs option;This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see PutTransformer.
If the log group uses either a log-group level or account-level transformer, and you specify true, the metric filter will be applied on the transformed version of the log events instead of the original ingested log events.
metric_transformations : metric_transformations;A collection of information that defines how metric data gets emitted.
*)filter_pattern : filter_pattern;A filter pattern for extracting metric data out of ingested log events.
*)filter_name : filter_name;A name for the metric filter.
*)log_group_name : log_group_name;The name of the log group.
*)}type nonrec put_log_group_deletion_protection_request = {deletion_protection_enabled : deletion_protection_enabled;Whether to enable deletion protection.
Type: Boolean
Required: Yes
*)log_group_identifier : log_group_identifier;The name or ARN of the log group.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 512.
Pattern: [\.\-_/#A-Za-z0-9]+
Required: Yes
*)}type nonrec put_log_events_response = {rejected_entity_info : rejected_entity_info option;Information about why the entity is rejected when calling PutLogEvents. Only returned when the entity is rejected.
When the entity is rejected, the events may still be accepted.
*)rejected_log_events_info : rejected_log_events_info option;The rejected events.
*)next_sequence_token : sequence_token option;The next sequence token.
This field has been deprecated.
The sequence token is now ignored in PutLogEvents actions. PutLogEvents actions are always accepted even if the sequence token is not valid. You can use parallel PutLogEvents actions on the same log stream and you do not need to wait for the response of a previous PutLogEvents action to obtain the nextSequenceToken value.
}type nonrec input_log_event = {message : event_message;The raw event message. Each log event can be no larger than 1 MB.
*)timestamp : timestamp;The time the event occurred, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
}Represents a log event, which is a record of activity that was recorded by the application or resource being monitored.
type nonrec input_log_events = input_log_event listtype nonrec entity_key_attributes =
(entity_key_attributes_key * entity_key_attributes_value) listtype nonrec entity_attributes =
(entity_attributes_key * entity_attributes_value) listtype nonrec entity = {attributes : entity_attributes option;Additional attributes of the entity that are not used to specify the identity of the entity. A list of key-value pairs.
For details about how to use the attributes, see How to add related information to telemetry in the CloudWatch User Guide.
*)key_attributes : entity_key_attributes option;The attributes of the entity which identify the specific entity, as a list of key-value pairs. Entities with the same keyAttributes are considered to be the same entity.
There are five allowed attributes (key names): Type, ResourceType, Identifier Name, and Environment.
For details about how to use the key attributes, see How to add related information to telemetry in the CloudWatch User Guide.
*)}The entity associated with the log events in a PutLogEvents call.
type nonrec put_log_events_request = {entity : entity option;The entity associated with the log events.
*)sequence_token : sequence_token option;The sequence token obtained from the response of the previous PutLogEvents call.
The sequenceToken parameter is now ignored in PutLogEvents actions. PutLogEvents actions are now accepted and never return InvalidSequenceTokenException or DataAlreadyAcceptedException even if the sequence token is not valid.
log_events : input_log_events;The log events.
*)log_stream_name : log_stream_name;The name of the log stream.
*)log_group_name : log_group_name;The name of the log group.
*)}type nonrec invalid_sequence_token_exception = {message : message option;expected_sequence_token : sequence_token option;}The sequence token is not valid. You can get the correct sequence token in the expectedSequenceToken field in the InvalidSequenceTokenException message.
PutLogEvents actions are now always accepted and never return InvalidSequenceTokenException regardless of receiving an invalid sequence token.
type nonrec data_already_accepted_exception = {message : message option;expected_sequence_token : sequence_token option;}The event was already logged.
PutLogEvents actions are now always accepted and never return DataAlreadyAcceptedException regardless of whether a given batch of log events has already been accepted.
type nonrec put_integration_response = {integration_status : integration_status option;The status of the integration that you just created.
After you create an integration, it takes a few minutes to complete. During this time, you'll see the status as PROVISIONING.
integration_name : integration_name option;The name of the integration that you just created.
*)}type nonrec put_integration_request = {integration_type : integration_type;The type of integration. Currently, the only supported type is OPENSEARCH.
resource_config : resource_config;A structure that contains configuration information for the integration that you are creating.
*)integration_name : integration_name;A name for the integration.
*)}type nonrec index_policy = {source : index_source option;This field indicates whether this is an account-level index policy or an index policy that applies only to a single log group.
*)policy_name : policy_name option;The name of this policy. Responses about log group-level field index policies don't have this field, because those policies don't have names.
*)policy_document : policy_document option;The policy document for this index policy, in JSON format.
*)last_update_time : timestamp option;The date and time that this index policy was most recently updated.
*)log_group_identifier : log_group_identifier option;The ARN of the log group that this index policy applies to.
*)}This structure contains information about one field index policy in this account.
type nonrec put_index_policy_response = {index_policy : index_policy option;The index policy that you just created or updated.
*)}type nonrec put_index_policy_request = {policy_document : policy_document;The index policy document, in JSON format. The following is an example of an index policy document that creates indexes with different types.
"policyDocument": "{"Fields": [ "TransactionId" ], "FieldsV2": {"RequestId": {"type": "FIELD_INDEX"}, "APIName": {"type": "FACET"}, "StatusCode": {"type": "FACET"}}}"
You can use FieldsV2 to specify the type for each field. Supported types are FIELD_INDEX and FACET. Field names within Fields and FieldsV2 must be mutually exclusive.
The policy document must include at least one field index. For more information about the fields that can be included and other restrictions, see Field index syntax and quotas.
*)log_group_identifier : log_group_identifier;Specify either the log group name or log group ARN to apply this field index policy to. If you specify an ARN, use the format arn:aws:logs:region:account-id:log-group:log_group_name Don't include an * at the end.
*)}type nonrec destination = {creation_time : timestamp option;The creation time of the destination, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
*)arn : arn option;The ARN of this destination.
*)access_policy : access_policy option;An IAM policy document that governs which Amazon Web Services accounts can create subscription filters against this destination.
*)role_arn : role_arn option;A role for impersonation, used when delivering log events to the target.
*)target_arn : target_arn option;The Amazon Resource Name (ARN) of the physical target where the log events are delivered (for example, a Kinesis stream).
*)destination_name : destination_name option;The name of the destination.
*)}Represents a cross-account destination that receives subscription log events.
type nonrec put_destination_request = {role_arn : role_arn;The ARN of an IAM role that grants CloudWatch Logs permissions to call the Amazon Kinesis PutRecord operation on the destination stream.
target_arn : target_arn;The ARN of an Amazon Kinesis stream to which to deliver matching log events.
*)destination_name : destination_name;A name for the destination.
*)}type nonrec put_destination_policy_request = {force_update : force_update option;Specify true if you are updating an existing destination policy to grant permission to an organization ID instead of granting permission to individual Amazon Web Services accounts. Before you update a destination policy this way, you must first update the subscription filters in the accounts that send logs to this destination. If you do not, the subscription filters might stop working. By specifying true for forceUpdate, you are affirming that you have already updated the subscription filters. For more information, see Updating an existing cross-account subscription
If you omit this parameter, the default of false is used.
access_policy : access_policy;An IAM policy document that authorizes cross-account users to deliver their log events to the associated destination. This can be up to 5120 bytes.
*)destination_name : destination_name;A name for an existing destination.
*)}type nonrec delivery_source_configuration =
(delivery_source_configuration_key * delivery_source_configuration_value)
listtype nonrec delivery_source = {status_reason : delivery_source_status_reason option;The reason for the status of the delivery source. A status reason of RESOURCE_DELETED indicates that the resource associated with the delivery source has been deleted. Note: This value is defined for selective log types.
status : delivery_source_status option;The status of the delivery source. A delivery source can have the status ACTIVE or INACTIVE. Note: This value is defined for selective log types.
delivery_source_configuration : delivery_source_configuration option;The map of key-value pairs that configure the delivery source.
*)log_type : log_type option;The type of log that the source is sending. For valid values for this parameter, see the documentation for the source service.
*)service : service option;The Amazon Web Services service that is sending logs.
*)resource_arns : resource_arns option;This array contains the ARN of the Amazon Web Services resource that sends logs and is represented by this delivery source. Currently, only one ARN can be in the array.
*)arn : arn option;The Amazon Resource Name (ARN) that uniquely identifies this delivery source.
*)name : delivery_source_name option;The unique name of the delivery source.
*)}This structure contains information about one delivery source in your account. A delivery source is an Amazon Web Services resource that sends logs to an Amazon Web Services destination. The destination can be CloudWatch Logs, Amazon S3, or Firehose.
Only some Amazon Web Services services support being configured as a delivery source. These services are listed as Supported [V2 Permissions] in the table at Enabling logging from Amazon Web Services services.
To configure logs delivery between a supported Amazon Web Services service and a destination, you must do the following:
You can configure a single delivery source to send logs to multiple destinations by creating multiple deliveries. You can also create multiple deliveries to configure multiple delivery sources to send logs to the same delivery destination.
type nonrec put_delivery_source_response = {delivery_source : delivery_source option;A structure containing information about the delivery source that was just created or updated.
*)}type nonrec put_delivery_source_request = {delivery_source_configuration : delivery_source_configuration option;A map of key-value pairs to configure the delivery source. Both keys and values must be between 1 and 255 characters in length. For example, {"samplingRate": "50"}.
log_type : log_type;Defines the type of log that the source is sending.
APPLICATION_LOGS and EVENT_LOGS.APPLICATION_LOGS.APPLICATION_LOGS, USAGE_LOGS and TRACES.APPLICATION_LOGS, USAGE_LOGS and TRACES.APPLICATION_LOGS and TRACES.APPLICATION_LOGS and TRACES.APPLICATION_LOGS and TRACES.APPLICATION_LOGS and TRACES.ACCESS_LOGS.APPLICATION_LOGS.EVENT_LOGS.EGRESS_ACCESS_LOGS and INGRESS_ACCESS_LOGS.AD_DECISION_SERVER_LOGS, MANIFEST_SERVICE_LOGS, and TRANSCODE_LOGS.AUTO_MODE_BLOCK_STORAGE_LOGS, AUTO_MODE_COMPUTE_LOGS, AUTO_MODE_IPAM_LOGS, and AUTO_MODE_LOAD_BALANCING_LOGS.EKS_CAPABILITY_ACK_LOGS, EKS_CAPABILITY_ARGOCD_APPLICATION_LOGS, EKS_CAPABILITY_ARGOCD_APPLICATIONSET_LOGS, EKS_CAPABILITY_ARGOCD_COMMITSERVER_LOGS, EKS_CAPABILITY_ARGOCD_REPOSERVER_LOGS, EKS_CAPABILITY_ARGOCD_SERVER_LOGS, and EKS_CAPABILITY_KRO_LOGS.WORKFLOW_LOGS.ERROR_LOGS.ALERT_LOGS, ALLOW_LOGS, and DENY_LOGS.NLB_ACCESS_LOGS.PCS_SCHEDULER_LOGS, PCS_JOBCOMP_LOGS, and PCS_SCHEDULER_AUDIT_LOGS.AGENT_HOURS_LOGS, CHAT_LOGS, FEEDBACK_LOGS, and INDEX_USAGE_LOGS.APPLICATION_LOGS.EVENT_LOGS and SYNC_JOB_LOGS.SECURITY_FINDING_LOGS.SECURITY_FINDING_LOGS.APPLICATION_LOGS and TRAFFIC_POLICY_DEBUG_LOGS.ACCESS_CONTROL_LOGS, AUTHENTICATION_LOGS, WORKMAIL_AVAILABILITY_PROVIDER_LOGS, WORKMAIL_MAILBOX_ACCESS_LOGS, and WORKMAIL_PERSONAL_ACCESS_TOKEN_LOGS.EVENT_LOGS.resource_arn : arn;The ARN of the Amazon Web Services resource that is generating and sending logs. For example, arn:aws:workmail:us-east-1:123456789012:organization/m-1234EXAMPLEabcd1234abcd1234abcd1234
For the SECURITY_FINDING_LOGS logType, use a wildcard ARN for the hub resource. For Amazon Web Services Security Hub CSPM, use arn:aws:securityhub:us-east-1:111122223333:hub/* and for Amazon Web Services Security Hub, use arn:aws:securityhub:us-east-1:111122223333:hubv2/*
name : delivery_source_name;A name for this delivery source. This name must be unique for all delivery sources in your account.
*)}type nonrec delivery_destination_configuration = {destination_resource_arn : arn;The ARN of the Amazon Web Services destination that this delivery destination represents. That Amazon Web Services destination can be a log group in CloudWatch Logs, an Amazon S3 bucket, or a delivery stream in Firehose.
*)}A structure that contains information about one logs delivery destination.
type nonrec delivery_destination = {delivery_destination_configuration : delivery_destination_configuration option;A structure that contains the ARN of the Amazon Web Services resource that will receive the logs.
*)output_format : output_format option;The format of the logs that are sent to this delivery destination.
*)delivery_destination_type : delivery_destination_type option;Displays whether this delivery destination is CloudWatch Logs, Amazon S3, Firehose, or X-Ray.
*)arn : arn option;The Amazon Resource Name (ARN) that uniquely identifies this delivery destination.
*)name : delivery_destination_name option;The name of this delivery destination.
*)}This structure contains information about one delivery destination in your account. A delivery destination is an Amazon Web Services resource that represents an Amazon Web Services service that logs can be sent to. CloudWatch Logs, Amazon S3, Firehose, and X-Ray are supported as delivery destinations.
To configure logs delivery between a supported Amazon Web Services service and a destination, you must do the following:
You can configure a single delivery source to send logs to multiple destinations by creating multiple deliveries. You can also create multiple deliveries to configure multiple delivery sources to send logs to the same delivery destination.
type nonrec put_delivery_destination_response = {delivery_destination : delivery_destination option;A structure containing information about the delivery destination that you just created or updated.
*)}type nonrec put_delivery_destination_request = {delivery_destination_type : delivery_destination_type option;The type of delivery destination. This parameter specifies the target service where log data will be delivered. Valid values include:
S3 - Amazon S3 for long-term storage and analyticsCWL - CloudWatch Logs for centralized log managementFH - Amazon Kinesis Data Firehose for real-time data streamingXRAY - Amazon Web Services X-Ray for distributed tracing and application monitoringThe delivery destination type determines the format and configuration options available for log delivery.
*)delivery_destination_configuration : delivery_destination_configuration option;A structure that contains the ARN of the Amazon Web Services resource that will receive the logs.
deliveryDestinationConfiguration is required for CloudWatch Logs, Amazon S3, Firehose log delivery destinations and not required for X-Ray trace delivery destinations. deliveryDestinationType is needed for X-Ray trace delivery destinations but not required for other logs delivery destinations.
output_format : output_format option;The format for the logs that this delivery destination will receive.
*)name : delivery_destination_name;A name for this delivery destination. This name must be unique for all delivery destinations in your account.
*)}type nonrec policy = {delivery_destination_policy : delivery_destination_policy option;The contents of the delivery destination policy.
*)}A structure that contains information about one delivery destination policy.
type nonrec put_delivery_destination_policy_response = {policy : policy option;The contents of the policy that you just created.
*)}type nonrec put_delivery_destination_policy_request = {delivery_destination_policy : delivery_destination_policy;The contents of the policy.
*)delivery_destination_name : delivery_destination_name;The name of the delivery destination to assign this policy to.
*)}type nonrec put_data_protection_policy_response = {last_updated_time : timestamp option;The date and time that this policy was most recently updated.
*)policy_document : data_protection_policy_document option;The data protection policy used for this log group.
*)log_group_identifier : log_group_identifier option;The log group name or ARN that you specified in your request.
*)}type nonrec put_data_protection_policy_request = {policy_document : data_protection_policy_document;Specify the data protection policy, in JSON.
This policy must include two JSON blocks:
The first block must include both a DataIdentifer array and an Operation property with an Audit action. The DataIdentifer array lists the types of sensitive data that you want to mask. For more information about the available options, see Types of data that you can mask.
The Operation property with an Audit action is required to find the sensitive data terms. This Audit action must contain a FindingsDestination object. You can optionally use that FindingsDestination object to list one or more destinations to send audit findings to. If you specify destinations such as log groups, Firehose streams, and S3 buckets, they must already exist.
The second block must include both a DataIdentifer array and an Operation property with an Deidentify action. The DataIdentifer array must exactly match the DataIdentifer array in the first block of the policy.
The Operation property with the Deidentify action is what actually masks the data, and it must contain the "MaskConfig": {} object. The "MaskConfig": {} object must be empty.
For an example data protection policy, see the Examples section on this page.
The contents of the two DataIdentifer arrays must match exactly.
In addition to the two JSON blocks, the policyDocument can also include Name, Description, and Version fields. The Name is used as a dimension when CloudWatch Logs reports audit findings metrics to CloudWatch.
The JSON specified in policyDocument can be up to 30,720 characters.
log_group_identifier : log_group_identifier;Specify either the log group name or log group ARN.
*)}type nonrec put_bearer_token_authentication_request = {bearer_token_authentication_enabled : bearer_token_authentication_enabled;Whether to enable bearer token authentication.
Type: Boolean
Required: Yes
*)log_group_identifier : log_group_identifier;The name or ARN of the log group.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 512.
Pattern: [\.\-_/#A-Za-z0-9]+
Required: Yes
*)}type nonrec account_policy = {account_id : account_id option;The Amazon Web Services account ID that the policy applies to.
*)selection_criteria : selection_criteria option;The log group selection criteria that is used for this policy.
*)scope : scope option;The scope of the account policy.
*)policy_type : policy_type option;The type of policy for this account policy.
*)last_updated_time : timestamp option;The date and time that this policy was most recently updated.
*)policy_document : account_policy_document option;The policy document for this account policy.
The JSON specified in policyDocument can be up to 30,720 characters.
policy_name : policy_name option;The name of the account policy.
*)}A structure that contains information about one CloudWatch Logs account policy.
type nonrec put_account_policy_response = {account_policy : account_policy option;The account policy that you created.
*)}type nonrec put_account_policy_request = {selection_criteria : selection_criteria option;Use this parameter to apply the new policy to a subset of log groups in the account or a data source name and type combination.
Specifying selectionCriteria is valid only when you specify SUBSCRIPTION_FILTER_POLICY, FIELD_INDEX_POLICY or TRANSFORMER_POLICYfor policyType.
policyType is SUBSCRIPTION_FILTER_POLICY, the only supported selectionCriteria filter is LogGroupName NOT IN []policyType is TRANSFORMER_POLICY, the only supported selectionCriteria filter is LogGroupNamePrefixIf policyType is FIELD_INDEX_POLICY, the supported selectionCriteria filters are:
LogGroupNamePrefixDataSourceName AND DataSourceTypeWhen you specify selectionCriteria for a field index policy you can use either LogGroupNamePrefix by itself or DataSourceName and DataSourceType together.
The selectionCriteria string can be up to 25KB in length. The length is determined by using its UTF-8 bytes.
Using the selectionCriteria parameter with SUBSCRIPTION_FILTER_POLICY is useful to help prevent infinite loops. For more information, see Log recursion prevention.
scope : scope option;Currently the only valid value for this parameter is ALL, which specifies that the data protection policy applies to all log groups in the account. If you omit this parameter, the default of ALL is used.
policy_type : policy_type;The type of policy that you're creating or updating.
*)policy_document : account_policy_document;Specify the policy, in JSON.
Data protection policy
A data protection policy must include two JSON blocks:
The first block must include both a DataIdentifer array and an Operation property with an Audit action. The DataIdentifer array lists the types of sensitive data that you want to mask. For more information about the available options, see Types of data that you can mask.
The Operation property with an Audit action is required to find the sensitive data terms. This Audit action must contain a FindingsDestination object. You can optionally use that FindingsDestination object to list one or more destinations to send audit findings to. If you specify destinations such as log groups, Firehose streams, and S3 buckets, they must already exist.
The second block must include both a DataIdentifer array and an Operation property with an Deidentify action. The DataIdentifer array must exactly match the DataIdentifer array in the first block of the policy.
The Operation property with the Deidentify action is what actually masks the data, and it must contain the "MaskConfig": {} object. The "MaskConfig": {} object must be empty.
For an example data protection policy, see the Examples section on this page.
The contents of the two DataIdentifer arrays must match exactly.
In addition to the two JSON blocks, the policyDocument can also include Name, Description, and Version fields. The Name is different than the operation's policyName parameter, and is used as a dimension when CloudWatch Logs reports audit findings metrics to CloudWatch.
The JSON specified in policyDocument can be up to 30,720 characters long.
Subscription filter policy
A subscription filter policy can include the following attributes in a JSON block:
DestinationArn The ARN of the destination to deliver log events to. Supported destinations are:
Random for a more even distribution. This property is only applicable when the destination is an Kinesis Data Streams data stream.Transformer policy
A transformer policy must include one JSON block with the array of processors and their configurations. For more information about available processors, see Processors that you can use.
Field index policy
A field index filter policy can include the following attribute in a JSON block:
It must contain at least one field index.
The following is an example of an index policy document that creates indexes with different types.
"policyDocument": "{ \"Fields\": [ \"TransactionId\" ], \"FieldsV2\": {\"RequestId\": {\"type\": \"FIELD_INDEX\"}, \"APIName\": {\"type\": \"FACET\"}, \"StatusCode\": {\"type\": \"FACET\"}}}"
You can use FieldsV2 to specify the type for each field. Supported types are FIELD_INDEX and FACET. Field names within Fields and FieldsV2 must be mutually exclusive.
policy_name : policy_name;A name for the policy. This must be unique within the account and cannot start with aws/.
}type nonrec enumerations = (token_string * token_value) listtype nonrec pattern_token = {inferred_token_name : inferred_token_name option;A name that CloudWatch Logs assigned to this dynamic token to make the pattern more readable. The string part of the inferredTokenName gives you a clearer idea of the content of this token. The number part of the inferredTokenName shows where in the pattern this token appears, compared to other dynamic tokens. CloudWatch Logs assigns the string part of the name based on analyzing the content of the log events that contain it.
For example, an inferred token name of IPAddress-3 means that the token represents an IP address, and this token is the third dynamic token in the pattern.
enumerations : enumerations option;Contains the values found for a dynamic token, and the number of times each value was found.
*)token_string : token_string option;The string represented by this token. If this is a dynamic token, the value will be <*>
is_dynamic : boolean_ option;Specifies whether this is a dynamic token.
*)dynamic_token_position : dynamic_token_position option;For a dynamic token, this indicates where in the pattern that this token appears, related to other dynamic tokens. The dynamic token that appears first has a value of 1, the one that appears second is 2, and so on.
}A structure that contains information about one pattern token related to an anomaly.
For more information about patterns and tokens, see CreateLogAnomalyDetector.
type nonrec pattern_tokens = pattern_token listtype nonrec output_log_event = {ingestion_time : timestamp option;The time the event was ingested, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
message : event_message option;The data contained in the log event.
*)timestamp : timestamp option;The time the event occurred, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
}Represents a log event.
type nonrec output_log_events = output_log_event listtype nonrec output_formats = output_format listtype nonrec open_search_resource_status = {status_message : integration_status_message option;A message with additional information about the status of this resource.
*)status : open_search_resource_status_type option;The current status of this resource.
*)}This structure contains information about the status of an OpenSearch Service resource.
type nonrec open_search_workspace = {status : open_search_resource_status option;This structure contains information about the status of an OpenSearch Service resource.
*)workspace_id : open_search_workspace_id option;The ID of this workspace.
*)}This structure contains information about the OpenSearch Service workspace used for this integration. An OpenSearch Service workspace is the collection of dashboards along with other OpenSearch Service tools. This workspace was created automatically as part of the integration setup. For more information, see Centralized OpenSearch user interface (Dashboards) with OpenSearch Service.
type nonrec open_search_network_policy = {status : open_search_resource_status option;This structure contains information about the status of this OpenSearch Service resource.
*)policy_name : open_search_policy_name option;The name of the network policy.
*)}This structure contains information about the OpenSearch Service network policy used for this integration. The network policy assigns network access settings to collections. For more information, see Network policies in the OpenSearch Service Developer Guide.
type nonrec open_search_lifecycle_policy = {status : open_search_resource_status option;This structure contains information about the status of this OpenSearch Service resource.
*)policy_name : open_search_policy_name option;The name of the lifecycle policy.
*)}This structure contains information about the OpenSearch Service data lifecycle policy used for this integration. The lifecycle policy determines the lifespan of the data in the collection. It was automatically created as part of the integration setup.
For more information, see Using data lifecycle policies with OpenSearch Service Serverless in the OpenSearch Service Developer Guide.
type nonrec open_search_data_source = {status : open_search_resource_status option;This structure contains information about the status of this OpenSearch Service resource.
*)data_source_name : open_search_data_source_name option;The name of the OpenSearch Service data source.
*)}This structure contains information about the OpenSearch Service data source used for this integration. This data source was created as part of the integration setup. An OpenSearch Service data source defines the source and destination for OpenSearch Service queries. It includes the role required to execute queries and write to collections.
For more information about OpenSearch Service data sources , see Creating OpenSearch Service data source integrations with Amazon S3.
type nonrec open_search_application = {status : open_search_resource_status option;This structure contains information about the status of this OpenSearch Service resource.
*)application_id : open_search_application_id option;The ID of the application.
*)application_arn : arn option;The Amazon Resource Name (ARN) of the application.
*)application_endpoint : open_search_application_endpoint option;The endpoint of the application.
*)}This structure contains information about the OpenSearch Service application used for this integration. An OpenSearch Service application is the web application created by the integration with CloudWatch Logs. It hosts the vended logs dashboards.
type nonrec open_search_collection = {status : open_search_resource_status option;This structure contains information about the status of this OpenSearch Service resource.
*)collection_arn : arn option;The ARN of the collection.
*)collection_endpoint : open_search_collection_endpoint option;The endpoint of the collection.
*)}This structure contains information about the OpenSearch Service collection used for this integration. An OpenSearch Service collection is a logical grouping of one or more indexes that represent an analytics workload. For more information, see Creating and managing OpenSearch Service Serverless collections.
type nonrec open_search_encryption_policy = {status : open_search_resource_status option;This structure contains information about the status of this OpenSearch Service resource.
*)policy_name : open_search_policy_name option;The name of the encryption policy.
*)}This structure contains information about the OpenSearch Service encryption policy used for this integration. The encryption policy was created automatically when you created the integration. For more information, see Encryption policies in the OpenSearch Service Developer Guide.
type nonrec open_search_data_access_policy = {status : open_search_resource_status option;This structure contains information about the status of this OpenSearch Service resource.
*)policy_name : open_search_policy_name option;The name of the data access policy.
*)}This structure contains information about the OpenSearch Service data access policy used for this integration. The access policy defines the access controls for the collection. This data access policy was automatically created as part of the integration setup. For more information about OpenSearch Service data access policies, see Data access control for Amazon OpenSearch Serverless in the OpenSearch Service Developer Guide.
type nonrec open_search_integration_details = {lifecycle_policy : open_search_lifecycle_policy option;This structure contains information about the OpenSearch Service data lifecycle policy used for this integration. The lifecycle policy determines the lifespan of the data in the collection. It was automatically created as part of the integration setup.
For more information, see Using data lifecycle policies with OpenSearch Service Serverless in the OpenSearch Service Developer Guide.
*)access_policy : open_search_data_access_policy option;This structure contains information about the OpenSearch Service data access policy used for this integration. The access policy defines the access controls for the collection. This data access policy was automatically created as part of the integration setup. For more information about OpenSearch Service data access policies, see Data access control for Amazon OpenSearch Serverless in the OpenSearch Service Developer Guide.
*)network_policy : open_search_network_policy option;This structure contains information about the OpenSearch Service network policy used for this integration. The network policy assigns network access settings to collections. For more information, see Network policies in the OpenSearch Service Developer Guide.
*)encryption_policy : open_search_encryption_policy option;This structure contains information about the OpenSearch Service encryption policy used for this integration. The encryption policy was created automatically when you created the integration. For more information, see Encryption policies in the OpenSearch Service Developer Guide.
*)workspace : open_search_workspace option;This structure contains information about the OpenSearch Service workspace used for this integration. An OpenSearch Service workspace is the collection of dashboards along with other OpenSearch Service tools. This workspace was created automatically as part of the integration setup. For more information, see Centralized OpenSearch user interface (Dashboards) with OpenSearch Service.
*)collection : open_search_collection option;This structure contains information about the OpenSearch Service collection used for this integration. This collection was created as part of the integration setup. An OpenSearch Service collection is a logical grouping of one or more indexes that represent an analytics workload. For more information, see Creating and managing OpenSearch Service Serverless collections.
*)application : open_search_application option;This structure contains information about the OpenSearch Service application used for this integration. An OpenSearch Service application is the web application that was created by the integration with CloudWatch Logs. It hosts the vended logs dashboards.
*)data_source : open_search_data_source option;This structure contains information about the OpenSearch Service data source used for this integration. This data source was created as part of the integration setup. An OpenSearch Service data source defines the source and destination for OpenSearch Service queries. It includes the role required to execute queries and write to collections.
For more information about OpenSearch Service data sources , see Creating OpenSearch Service data source integrations with Amazon S3.
*)}This structure contains complete information about one CloudWatch Logs integration. This structure is returned by a GetIntegration operation.
type nonrec metric_filter = {emit_system_field_dimensions : emit_system_fields option;The list of system fields that are emitted as additional dimensions in the generated metrics. Returns the emitSystemFieldDimensions value if it was specified when the metric filter was created.
field_selection_criteria : field_selection_criteria option;The filter expression that specifies which log events are processed by this metric filter based on system fields. Returns the fieldSelectionCriteria value if it was specified when the metric filter was created.
apply_on_transformed_logs : apply_on_transformed_logs option;This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see PutTransformer.
If this value is true, the metric filter is applied on the transformed version of the log events instead of the original ingested log events.
log_group_name : log_group_name option;The name of the log group.
*)creation_time : timestamp option;The creation time of the metric filter, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
metric_transformations : metric_transformations option;The metric transformations.
*)filter_pattern : filter_pattern option;filter_name : filter_name option;The name of the metric filter.
*)}Metric filters express how CloudWatch Logs would extract metric observations from ingested log events and transform them into metric data in a CloudWatch metric.
type nonrec metric_filters = metric_filter listtype nonrec lookup_table = {kms_key_id : kms_key_id option;The ARN of the KMS key used to encrypt the lookup table data, if applicable.
*)last_updated_time : timestamp option;The time when the lookup table was last updated, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
size_bytes : stored_bytes option;The size of the lookup table in bytes.
*)records_count : records_count option;The number of data rows in the lookup table, excluding the header row.
*)table_fields : table_fields option;The column headers from the first row of the CSV file.
*)description : lookup_table_description option;The description of the lookup table.
*)lookup_table_name : lookup_table_name option;The name of the lookup table.
*)lookup_table_arn : arn option;The ARN of the lookup table.
*)}Contains metadata about a lookup table returned by DescribeLookupTables.
type nonrec lookup_tables = lookup_table listtype nonrec list_syslog_configurations_response = {next_token : next_token option;The token for the next set of items to return. The token expires after 24 hours.
*)syslog_configurations : syslog_configurations option;The list of syslog configurations.
*)}type nonrec list_syslog_configurations_request = {max_results : list_syslog_configurations_max_results option;The maximum number of syslog configurations to return in the response.
*)next_token : next_token option;The token for the next set of items to return. You received this token from a previous call.
*)vpc_endpoint_id : vpc_endpoint_id option;The ID of the VPC endpoint to filter syslog configurations for.
*)log_group_identifier : log_group_identifier option;The name or ARN of the log group to filter syslog configurations for.
*)}type nonrec list_sources_for_s3_table_integration_response = {next_token : next_token option;sources : s3_table_integration_sources option;The list of data source associations for the specified S3 Table Integration.
*)}type nonrec list_sources_for_s3_table_integration_request = {next_token : next_token option;max_results : list_sources_for_s3_table_integration_max_results option;The maximum number of associations to return in a single call. Valid range is 1 to 100.
*)integration_arn : arn;The Amazon Resource Name (ARN) of the S3 Table Integration to list associations for.
*)}type nonrec list_scheduled_queries_response = {scheduled_queries : scheduled_query_summary_list option;An array of scheduled query summary information.
*)next_token : next_token option;}type nonrec list_scheduled_queries_request = {schedule_type : schedule_type option;Filter scheduled queries by schedule type. Valid values are CUSTOMER_MANAGED and AWS_MANAGED. If not specified, scheduled queries of all schedule types are returned.
state : scheduled_query_state option;Filter scheduled queries by state. Valid values are ENABLED and DISABLED. If not specified, all scheduled queries are returned.
next_token : next_token option;max_results : list_scheduled_queries_max_results option;The maximum number of scheduled queries to return. Valid range is 1 to 1000.
*)}type nonrec list_log_groups_for_query_response = {next_token : next_token option;log_group_identifiers : log_group_identifiers option;An array of the names and ARNs of the log groups that were processed in the query.
*)}type nonrec list_log_groups_for_query_request = {max_results : list_log_groups_for_query_max_results option;Limits the number of returned log groups to the specified number.
*)next_token : next_token option;query_id : query_id;}type nonrec log_group_summary = {log_group_class : log_group_class option;The log group class for this log group. For details about the features supported by each log group class, see Log classes
*)log_group_arn : arn option;The Amazon Resource Name (ARN) of the log group.
*)log_group_name : log_group_name option;The name of the log group.
*)}This structure contains information about one log group in your account.
type nonrec log_group_summaries = log_group_summary listtype nonrec list_log_groups_response = {next_token : next_token option;log_groups : log_group_summaries option;An array of structures, where each structure contains the information about one log group.
*)}type nonrec account_ids = account_id listtype nonrec data_source_filter = {type_ : data_source_type option;The type pattern to filter data sources by.
*)name : data_source_name;The name pattern to filter data sources by.
*)}Filter criteria for data sources, used to specify which data sources to include in operations based on name and type.
type nonrec data_source_filters = data_source_filter listtype nonrec field_index_names = field_index_name listtype nonrec list_log_groups_request = {field_index_names : field_index_names option;An array of field index names to filter log groups that have specific field indexes. Only log groups containing all specified field indexes are returned. You can specify 1 to 20 field index names, each with 1 to 512 characters.
*)data_sources : data_source_filters option;An array of data source filters to filter log groups by their associated data sources. You can filter by data source name, type, or both. Multiple filters within the same dimension are combined with OR logic, while filters across different dimensions are combined with AND logic.
*)limit : list_limit option;The maximum number of log groups to return. If you omit this parameter, the default is up to 50 log groups.
*)next_token : next_token option;account_identifiers : account_ids option;When includeLinkedAccounts is set to true, use this parameter to specify the list of accounts to search. You can specify as many as 20 account IDs in the array.
include_linked_accounts : include_linked_accounts option;If you are using a monitoring account, set this to true to have the operation return log groups in the accounts listed in accountIdentifiers.
If this parameter is set to true and accountIdentifiers contains a null value, the operation returns all log groups in the monitoring account and all log groups in all source accounts that are linked to the monitoring account.
The default for this parameter is false.
log_group_class : log_group_class option;Use this parameter to limit the results to only those log groups in the specified log group class. If you omit this parameter, log groups of all classes can be returned.
*)log_group_name_pattern : log_group_name_regex_pattern option;Use this parameter to limit the returned log groups to only those with names that match the pattern that you specify. This parameter is a regular expression that can match prefixes and substrings, and supports wildcard matching and matching multiple patterns, as in the following examples.
^ to match log group names by prefix.| as in the example ^/aws/lambda|discoveryYou can specify as many as five different regular expression patterns in this field, each of which must be between 3 and 24 characters. You can include the ^ symbol as many as five times, and include the | symbol as many as four times.
}type nonrec log_group_arn_list = log_group_arn listtype nonrec epoch_millis = Smaws_Lib.CoreTypes.Int64.ttype nonrec anomaly_detector = {anomaly_visibility_time : anomaly_visibility_time option;The number of days used as the life cycle of anomalies. After this time, anomalies are automatically baselined and the anomaly detector model will treat new occurrences of similar event as normal.
*)last_modified_time_stamp : epoch_millis option;The date and time when this anomaly detector was most recently modified.
*)creation_time_stamp : epoch_millis option;The date and time when this anomaly detector was created.
*)kms_key_id : kms_key_id option;The ARN of the KMS key assigned to this anomaly detector, if any.
*)anomaly_detector_status : anomaly_detector_status option;Specifies the current status of the anomaly detector. To pause an anomaly detector, use the enabled parameter in the UpdateLogAnomalyDetector operation.
filter_pattern : filter_pattern option;evaluation_frequency : evaluation_frequency option;Specifies how often the anomaly detector runs and look for anomalies.
*)log_group_arn_list : log_group_arn_list option;A list of the ARNs of the log groups that this anomaly detector watches.
*)detector_name : detector_name option;The name of the anomaly detector.
*)anomaly_detector_arn : anomaly_detector_arn option;The ARN of the anomaly detector.
*)}Contains information about one anomaly detector in the account.
type nonrec anomaly_detectors = anomaly_detector listtype nonrec list_log_anomaly_detectors_response = {next_token : next_token option;anomaly_detectors : anomaly_detectors option;An array of structures, where each structure in the array contains information about one anomaly detector.
*)}type nonrec list_log_anomaly_detectors_request = {next_token : next_token option;limit : list_log_anomaly_detectors_limit option;The maximum number of items to return. If you don't specify a value, the default maximum value of 50 items is used.
*)filter_log_group_arn : log_group_arn option;Use this to optionally filter the results to only include anomaly detectors that are associated with the specified log group.
*)}type nonrec integration_summary = {integration_status : integration_status option;The current status of this integration.
*)integration_type : integration_type option;The type of integration. Integrations with OpenSearch Service have the type OPENSEARCH.
integration_name : integration_name option;The name of this integration.
*)}This structure contains information about one CloudWatch Logs integration. This structure is returned by a ListIntegrations operation.
type nonrec integration_summaries = integration_summary listtype nonrec list_integrations_response = {integration_summaries : integration_summaries option;An array, where each object in the array contains information about one CloudWatch Logs integration in this account.
*)}type nonrec list_integrations_request = {integration_status : integration_status option;To limit the results to integrations with a certain status, specify that status here.
*)integration_type : integration_type option;To limit the results to integrations of a certain type, specify that type here.
*)integration_name_prefix : integration_name_prefix option;To limit the results to integrations that start with a certain name prefix, specify that name prefix here.
*)}type nonrec count = Smaws_Lib.CoreTypes.Int64.ttype nonrec log_event = {message : event_message option;The message content of the log event.
*)timestamp : timestamp option;The time stamp of the log event.
*)}This structure contains the information for one sample log event that is associated with an anomaly found by a log anomaly detector.
type nonrec log_samples = log_event listtype nonrec anomaly = {is_pattern_level_suppression : boolean_ option;If this anomaly is suppressed, this field is true if the suppression is because the pattern is suppressed. If false, then only this particular anomaly is suppressed.
suppressed_until : epoch_millis option;If the anomaly is suppressed, this indicates when the suppression will end. If this value is 0, the anomaly was suppressed with no expiration, with the INFINITE value.
suppressed_date : epoch_millis option;If the anomaly is suppressed, this indicates when it was suppressed.
*)suppressed : boolean_ option;Indicates whether this anomaly is currently suppressed. To suppress an anomaly, use UpdateAnomaly.
*)log_group_arn_list : log_group_arn_list;An array of ARNS of the log groups that contained log events considered to be part of this anomaly.
*)pattern_tokens : pattern_tokens;An array of structures where each structure contains information about one token that makes up the pattern.
*)log_samples : log_samples;An array of sample log event messages that are considered to be part of this anomaly.
*)histogram : histogram;A map showing times when the anomaly detector ran, and the number of occurrences of this anomaly that were detected at each of those runs. The times are specified in epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.
state : state;Indicates the current state of this anomaly. If it is still being treated as an anomaly, the value is Active. If you have suppressed this anomaly by using the UpdateAnomaly operation, the value is Suppressed. If this behavior is now considered to be normal, the value is Baseline.
active : boolean_;Specifies whether this anomaly is still ongoing.
*)description : description;A human-readable description of the anomaly. This description is generated by CloudWatch Logs.
*)last_seen : epoch_millis;The date and time when the anomaly detector most recently saw this anomaly. It is specified as epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.
first_seen : epoch_millis;The date and time when the anomaly detector first saw this anomaly. It is specified as epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.
priority : priority option;The priority level of this anomaly, as determined by CloudWatch Logs. Priority is computed based on log severity labels such as FATAL and ERROR and the amount of deviation from the baseline. Possible values are HIGH, MEDIUM, and LOW.
pattern_regex : pattern_regex option;The pattern used to help identify this anomaly, in regular expression format.
*)pattern_string : pattern_string;The pattern used to help identify this anomaly, in string format.
*)anomaly_detector_arn : anomaly_detector_arn;The ARN of the anomaly detector that identified this anomaly.
*)pattern_id : pattern_id;The ID of the pattern used to help identify this anomaly.
*)anomaly_id : anomaly_id;The unique ID that CloudWatch Logs assigned to this anomaly.
*)}This structure represents one anomaly that has been found by a logs anomaly detector.
For more information about patterns and anomalies, see CreateLogAnomalyDetector.
type nonrec anomalies = anomaly listtype nonrec list_anomalies_response = {next_token : next_token option;anomalies : anomalies option;An array of structures, where each structure contains information about one anomaly that a log anomaly detector has found.
*)}type nonrec list_anomalies_request = {next_token : next_token option;limit : list_anomalies_limit option;The maximum number of items to return. If you don't specify a value, the default maximum value of 50 items is used.
*)suppression_state : suppression_state option;You can specify this parameter if you want to the operation to return only anomalies that are currently either suppressed or unsuppressed.
*)anomaly_detector_arn : anomaly_detector_arn option;Use this to optionally limit the results to only the anomalies found by a certain anomaly detector.
*)}type nonrec grouping_identifier = {value : grouping_identifier_value option;The value associated with the grouping characteristic. Examples are amazon_vpc, flow, and OCSF.
key : grouping_identifier_key option;The key that identifies the grouping characteristic. The format of the key uses dot notation. Examples are, dataSource.Name, dataSource.Type, and dataSource.Format.
}A key-value pair that identifies how log groups are grouped in aggregate summaries.
type nonrec grouping_identifiers = grouping_identifier listtype nonrec aggregate_log_group_summary = {grouping_identifiers : grouping_identifiers option;An array of key-value pairs that identify the data source characteristics used to group the log groups.
The size and content of this array depends on the groupBy parameter specified in the request.
log_group_count : log_group_count option;The number of log groups in this aggregate summary group.
*)}Contains an aggregate summary of log groups grouped by data source characteristics, including the count of log groups and their grouping identifiers.
type nonrec aggregate_log_group_summaries = aggregate_log_group_summary listtype nonrec list_aggregate_log_group_summaries_response = {next_token : next_token option;aggregate_log_group_summaries : aggregate_log_group_summaries option;The list of aggregate log group summaries grouped by the specified data source characteristics.
*)}type nonrec list_aggregate_log_group_summaries_request = {limit : list_log_groups_request_limit option;The maximum number of aggregated summaries to return. If you omit this parameter, the default is up to 50 aggregated summaries.
*)next_token : next_token option;group_by : list_aggregate_log_group_summaries_group_by;Specifies how to group the log groups in the summary.
*)data_sources : data_source_filters option;Filters the results by data source characteristics to include only log groups associated with the specified data sources.
*)log_group_name_pattern : log_group_name_regex_pattern option;Use this parameter to limit the returned log groups to only those with names that match the pattern that you specify. This parameter is a regular expression that can match prefixes and substrings, and supports wildcard matching and matching multiple patterns, as in the following examples.
^ to match log group names by prefix.| as in the example ^/aws/lambda|discoveryYou can specify as many as five different regular expression patterns in this field, each of which must be between 3 and 24 characters. You can include the ^ symbol as many as five times, and include the | symbol as many as four times.
log_group_class : log_group_class option;Filters the results by log group class to include only log groups of the specified class.
*)include_linked_accounts : include_linked_accounts option;If you are using a monitoring account, set this to true to have the operation return log groups in the accounts listed in accountIdentifiers.
If this parameter is set to true and accountIdentifiers contains a null value, the operation returns all log groups in the monitoring account and all log groups in all source accounts that are linked to the monitoring account.
The default for this parameter is false.
account_identifiers : account_ids option;When includeLinkedAccounts is set to true, use this parameter to specify the list of accounts to search. You can specify as many as 20 account IDs in the array.
}type nonrec get_transformer_response = {transformer_config : processors option;This sructure contains the configuration of the requested transformer.
*)last_modified_time : timestamp option;The date and time when this transformer was most recently modified, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
*)creation_time : timestamp option;The creation time of the transformer, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
*)log_group_identifier : log_group_identifier option;The ARN of the log group that you specified in your request.
*)}type nonrec get_transformer_request = {log_group_identifier : log_group_identifier;Specify either the name or ARN of the log group to return transformer information for. If the log group is in a source account and you are using a monitoring account, you must use the log group ARN.
*)}type nonrec get_scheduled_query_history_response = {next_token : next_token option;trigger_history : trigger_history_record_list option;An array of execution history records for the scheduled query.
*)scheduled_query_arn : arn option;The ARN of the scheduled query.
*)name : scheduled_query_name option;The name of the scheduled query.
*)}type nonrec execution_status_list = execution_status listtype nonrec get_scheduled_query_history_request = {next_token : next_token option;max_results : get_scheduled_query_history_max_results option;The maximum number of history records to return. Valid range is 1 to 1000.
*)execution_statuses : execution_status_list option;An array of execution statuses to filter the history results. Only executions with the specified statuses are returned.
*)end_time : timestamp;The end time for the history query in Unix epoch format.
*)start_time : timestamp;The start time for the history query in Unix epoch format.
*)identifier : scheduled_query_identifier;The ARN or name of the scheduled query to retrieve history for.
*)}type nonrec get_scheduled_query_response = {last_updated_time : timestamp option;The timestamp when the scheduled query was last updated.
*)creation_time : timestamp option;The timestamp when the scheduled query was created.
*)execution_role_arn : role_arn option;The ARN of the IAM role used to execute the query and deliver results.
*)schedule_end_time : timestamp option;The end time for the scheduled query in Unix epoch format.
*)schedule_start_time : timestamp option;The start time for the scheduled query in Unix epoch format.
*)last_execution_status : execution_status option;The status of the most recent execution of the scheduled query.
*)last_triggered_time : timestamp option;The timestamp when the scheduled query was last executed.
*)schedule_type : schedule_type option;The schedule type of the scheduled query. Valid values are CUSTOMER_MANAGED and AWS_MANAGED.
state : scheduled_query_state option;The current state of the scheduled query.
*)destination_configuration : destination_configuration option;Configuration for where query results are delivered.
*)end_time_offset : end_time_offset option;The time offset in seconds that defines the end of the lookback period for the query.
*)start_time_offset : start_time_offset option;The time offset in seconds that defines the lookback period for the query.
*)timezone : schedule_timezone option;The timezone used for evaluating the schedule expression.
*)schedule_expression : schedule_expression option;The cron expression that defines when the scheduled query runs.
*)log_group_identifiers : scheduled_query_log_group_identifiers option;The log groups queried by the scheduled query.
*)query_string : query_string option;The query string executed by the scheduled query.
*)query_language : query_language option;The query language used by the scheduled query.
*)description : scheduled_query_description option;The description of the scheduled query.
*)name : scheduled_query_name option;The name of the scheduled query.
*)scheduled_query_arn : arn option;The ARN of the scheduled query.
*)}type nonrec get_scheduled_query_request = {identifier : scheduled_query_identifier;The ARN or name of the scheduled query to retrieve.
*)}type nonrec get_query_results_response = {next_token : get_query_results_next_token option;If there are more log events remaining in the results, the response includes a nextToken. You can use this token in a subsequent GetQueryResults request to get the next set of results. You can retrieve up to 100,000 log event results from a query by paginating with this token. This is only supported for Logs Insights QL and is currently not supported for PPL and SQL query languages.
encryption_key : encryption_key option;If you associated an KMS key with the CloudWatch Logs Insights query results in this account, this field displays the ARN of the key that's used to encrypt the query results when StartQuery stores them.
*)status : query_status option;The status of the most recent running of the query. Possible values are Cancelled, Complete, Failed, Running, Scheduled, Timeout, and Unknown.
Queries time out after 60 minutes of runtime. To avoid having your queries time out, reduce the time range being searched or partition your query into a number of queries.
*)statistics : query_statistics option;Includes the number of log events scanned by the query, the number of log events that matched the query criteria, and the total number of bytes in the scanned log events. These values reflect the full raw results of the query.
*)results : query_results option;The log events that matched the query criteria during the most recent time it ran.
The results value is an array of arrays. Each log event is one object in the top-level array. Each of these log event objects is an array of field/value pairs.
query_language : query_language option;The query language used for this query. For more information about the query languages that CloudWatch Logs supports, see Supported query languages.
*)}type nonrec get_query_results_request = {max_items : get_query_results_max_items option;The maximum number of log events to return in the response. The maximum is 10,000 log events per request. You can retrieve up to 100,000 log event results from a query by paginating with the nextToken.
next_token : get_query_results_next_token option;The token for the next set of items to return. The token expires after 1 hour.
*)query_id : query_id;The ID number of the query.
*)}type nonrec get_lookup_table_response = {kms_key_id : kms_key_id option;The ARN of the KMS key used to encrypt the lookup table data, if applicable.
*)last_updated_time : timestamp option;The time when the lookup table was last updated, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
size_bytes : stored_bytes option;The size of the lookup table in bytes.
*)table_body : table_body option;The full CSV content of the lookup table.
*)description : lookup_table_description option;The description of the lookup table.
*)lookup_table_name : lookup_table_name option;The name of the lookup table.
*)lookup_table_arn : arn option;The ARN of the lookup table.
*)}type nonrec get_lookup_table_request = {lookup_table_arn : arn;The ARN of the lookup table to retrieve.
*)}type nonrec get_log_record_response = {log_record : log_record option;The requested log event, as a JSON string.
*)}type nonrec get_log_record_request = {unmask : unmask option;Specify true to display the log event fields with all sensitive data unmasked and visible. The default is false.
To use this operation with this parameter, you must be signed into an account with the logs:Unmask permission.
log_record_pointer : log_record_pointer;The pointer corresponding to the log event record you want to retrieve. You get this from the response of a GetQueryResults operation. In that response, the value of the @ptr field for a log event is the value to use as logRecordPointer to retrieve that complete log event record.
}type nonrec fields_data = {data : data option;The actual log data content returned in the streaming response. This contains the fields and values of the log event in a structured format that can be parsed and processed by the client.
*)}A structure containing the extracted fields from a log event. These fields are extracted based on the log format and can be used for structured querying and analysis.
An internal error occurred during the streaming of log data. This exception is thrown when there's an issue with the internal streaming mechanism used by the GetLogObject operation.
type nonrec get_log_object_response_stream = | InternalStreamingException of internal_streaming_exceptionAn internal error occurred during the streaming of log data. This exception is thrown when there's an issue with the internal streaming mechanism used by the GetLogObject operation.
*)| Fields of fields_dataA stream of structured log data returned by the GetLogObject operation. This stream contains log events with their associated metadata and extracted fields.
type nonrec get_log_object_response = {field_stream : get_log_object_response_stream option;A stream of structured log data returned by the GetLogObject operation. This stream contains log events with their associated metadata and extracted fields.
*)}The response from the GetLogObject operation.
type nonrec get_log_object_request = {log_object_pointer : log_object_pointer;A pointer to the specific log object to retrieve. This is a required parameter that uniquely identifies the log object within CloudWatch Logs. The pointer is typically obtained from a previous query or filter operation.
*)unmask : unmask option;A boolean flag that indicates whether to unmask sensitive log data. When set to true, any masked or redacted data in the log object will be displayed in its original form. Default is false.
*)}The parameters for the GetLogObject operation.
type nonrec log_group_field = {percent : percentage option;The percentage of log events queried that contained the field.
*)name : field option;The name of a log field.
*)}The fields contained in log events found by a GetLogGroupFields operation, along with the percentage of queried log events in which each field appears.
type nonrec log_group_field_list = log_group_field listtype nonrec get_log_group_fields_response = {log_group_fields : log_group_field_list option;The array of fields found in the query. Each object in the array contains the name of the field, along with the percentage of time it appeared in the log events that were queried.
*)}type nonrec get_log_group_fields_request = {log_group_identifier : log_group_identifier option;Specify either the name or ARN of the log group to view. If the log group is in a source account and you are using a monitoring account, you must specify the ARN.
You must include either logGroupIdentifier or logGroupName, but not both.
time : timestamp option;The time to set as the center of the query. If you specify time, the 8 minutes before and 8 minutes after this time are searched. If you omit time, the most recent 15 minutes up to the current time are searched.
The time value is specified as epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.
log_group_name : log_group_name option;The name of the log group to search.
You must include either logGroupIdentifier or logGroupName, but not both.
}type log_field_type = {fields : log_fields_list option;For complex types, contains the nested field definitions.
*)element : log_field_type option;For array or collection types, specifies the element type information.
*)type_ : data_type option;The data type of the log field.
*)}Defines the data type structure for a log field, including the type, element information, and nested fields for complex types.
and log_fields_list = log_fields_list_item listand log_fields_list_item = {log_field_type : log_field_type option;The data type information for the log field.
*)log_field_name : log_field_name option;The name of the log field.
*)}Represents a log field with its name and data type information for a specific data source.
type nonrec get_log_fields_response = {log_fields : log_fields_list option;The list of log fields for the specified data source, including field names and their data types.
*)}type nonrec get_log_fields_request = {data_source_type : data_source_type;The type of the data source to retrieve log fields for.
*)data_source_name : data_source_name;The name of the data source to retrieve log fields for.
*)}type nonrec get_log_events_response = {next_backward_token : next_token option;The token for the next set of items in the backward direction. The token expires after 24 hours. This token is not null. If you have reached the end of the stream, it returns the same token you passed in.
*)next_forward_token : next_token option;The token for the next set of items in the forward direction. The token expires after 24 hours. If you have reached the end of the stream, it returns the same token you passed in.
*)events : output_log_events option;The events.
*)}type nonrec get_log_events_request = {unmask : unmask option;Specify true to display the log event fields with all sensitive data unmasked and visible. The default is false.
To use this operation with this parameter, you must be signed into an account with the logs:Unmask permission.
start_from_head : start_from_head option;If the value is true, the earliest log events are returned first. If the value is false, the latest log events are returned first. The default value is false.
If you are using a previous nextForwardToken value as the nextToken in this operation, you must specify true for startFromHead.
limit : events_limit option;The maximum number of log events returned. If you don't specify a limit, the default is as many log events as can fit in a response size of 1 MB (up to 10,000 log events).
*)next_token : next_token option;The token for the next set of items to return. (You received this token from a previous call.)
*)end_time : timestamp option;The end of the time range, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Events with a timestamp equal to or later than this time are not included.
start_time : timestamp option;The start of the time range, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Events with a timestamp equal to this time or later than this time are included. Events with a timestamp earlier than this time are not included.
log_stream_name : log_stream_name;The name of the log stream.
*)log_group_identifier : log_group_identifier option;Specify either the name or ARN of the log group to view events from. If the log group is in a source account and you are using a monitoring account, you must use the log group ARN.
You must include either logGroupIdentifier or logGroupName, but not both.
log_group_name : log_group_name option;The name of the log group.
You must include either logGroupIdentifier or logGroupName, but not both.
}type nonrec get_log_anomaly_detector_response = {anomaly_visibility_time : anomaly_visibility_time option;The number of days used as the life cycle of anomalies. After this time, anomalies are automatically baselined and the anomaly detector model will treat new occurrences of similar event as normal.
*)last_modified_time_stamp : epoch_millis option;The date and time when this anomaly detector was most recently modified.
*)creation_time_stamp : epoch_millis option;The date and time when this anomaly detector was created.
*)kms_key_id : kms_key_id option;The ARN of the KMS key assigned to this anomaly detector, if any.
*)anomaly_detector_status : anomaly_detector_status option;Specifies whether the anomaly detector is currently active. To change its status, use the enabled parameter in the UpdateLogAnomalyDetector operation.
filter_pattern : filter_pattern option;evaluation_frequency : evaluation_frequency option;Specifies how often the anomaly detector runs and look for anomalies. Set this value according to the frequency that the log group receives new logs. For example, if the log group receives new log events every 10 minutes, then setting evaluationFrequency to FIFTEEN_MIN might be appropriate.
log_group_arn_list : log_group_arn_list option;An array of structures, where each structure contains the ARN of a log group associated with this anomaly detector.
*)detector_name : detector_name option;The name of the log anomaly detector
*)}type nonrec get_log_anomaly_detector_request = {anomaly_detector_arn : anomaly_detector_arn;The ARN of the anomaly detector to retrieve information about. You can find the ARNs of log anomaly detectors in your account by using the ListLogAnomalyDetectors operation.
*)}type nonrec integration_details = | OpenSearchIntegrationDetails of open_search_integration_detailsThis structure contains complete information about one integration between CloudWatch Logs and OpenSearch Service.
*)This structure contains information about the integration configuration. For an integration with OpenSearch Service, this includes information about OpenSearch Service resources such as the collection, the workspace, and policies.
This structure is returned by a GetIntegration operation.
type nonrec get_integration_response = {integration_details : integration_details option;A structure that contains information about the integration configuration. For an integration with OpenSearch Service, this includes information about OpenSearch Service resources such as the collection, the workspace, and policies.
*)integration_status : integration_status option;The current status of this integration.
*)integration_type : integration_type option;The type of integration. Integrations with OpenSearch Service have the type OPENSEARCH.
integration_name : integration_name option;The name of the integration.
*)}type nonrec get_integration_request = {integration_name : integration_name;The name of the integration that you want to find information about. To find the name of your integration, use ListIntegrations
*)}type nonrec get_delivery_source_response = {delivery_source : delivery_source option;A structure containing information about the delivery source.
*)}type nonrec get_delivery_source_request = {name : delivery_source_name;The name of the delivery source that you want to retrieve.
*)}type nonrec get_delivery_destination_policy_response = {policy : policy option;The IAM policy for this delivery destination.
*)}type nonrec get_delivery_destination_policy_request = {delivery_destination_name : delivery_destination_name;The name of the delivery destination that you want to retrieve the policy of.
*)}type nonrec get_delivery_destination_response = {delivery_destination : delivery_destination option;A structure containing information about the delivery destination.
*)}type nonrec get_delivery_destination_request = {name : delivery_destination_name;The name of the delivery destination that you want to retrieve.
*)}type nonrec delivery = {s3_delivery_configuration : s3_delivery_configuration option;This structure contains delivery configurations that apply only when the delivery destination resource is an S3 bucket.
*)field_delimiter : field_delimiter option;The field delimiter that is used between record fields when the final output format of a delivery is in Plain, W3C, or Raw format.
record_fields : record_fields option;The record fields used in this delivery.
*)delivery_destination_type : delivery_destination_type option;Displays whether the delivery destination associated with this delivery is CloudWatch Logs, Amazon S3, Firehose, or X-Ray.
*)delivery_destination_arn : arn option;The ARN of the delivery destination that is associated with this delivery.
*)delivery_source_name : delivery_source_name option;The name of the delivery source that is associated with this delivery.
*)arn : arn option;The Amazon Resource Name (ARN) that uniquely identifies this delivery.
*)id : delivery_id option;The unique ID that identifies this delivery in your account.
*)}This structure contains information about one delivery in your account.
A delivery is a connection between a logical delivery source and a logical delivery destination.
For more information, see CreateDelivery.
To update an existing delivery configuration, use UpdateDeliveryConfiguration.
type nonrec get_delivery_response = {delivery : delivery option;A structure that contains information about the delivery.
*)}type nonrec get_delivery_request = {id : delivery_id;The ID of the delivery that you want to retrieve.
*)}type nonrec get_data_protection_policy_response = {last_updated_time : timestamp option;The date and time that this policy was most recently updated.
*)policy_document : data_protection_policy_document option;The data protection policy document for this log group.
*)log_group_identifier : log_group_identifier option;The log group name or ARN that you specified in your request.
*)}type nonrec get_data_protection_policy_request = {log_group_identifier : log_group_identifier;The name or ARN of the log group that contains the data protection policy that you want to see.
*)}type nonrec filtered_log_event = {event_id : event_id option;The ID of the event.
*)ingestion_time : timestamp option;The time the event was ingested, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
message : event_message option;The data contained in the log event.
*)timestamp : timestamp option;The time the event occurred, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
log_stream_name : log_stream_name option;The name of the log stream to which this event belongs.
*)}Represents a matched event.
type nonrec filtered_log_events = filtered_log_event listtype nonrec filter_log_events_response = {next_token : next_token option;The token for the next set of items in the sorting direction specified by the startFromHead parameter in the first request. The token expires after 24 hours.
If the results don't include a nextToken, then pagination is finished.
searched_log_streams : searched_log_streams option;Important As of May 15, 2020, this parameter is no longer supported. This parameter returns an empty list.
Indicates which log streams have been searched and whether each has been searched completely.
*)events : filtered_log_events option;The matched events.
*)}type nonrec filter_log_events_request = {unmask : unmask option;Specify true to display the log event fields with all sensitive data unmasked and visible. The default is false.
To use this operation with this parameter, you must be signed into an account with the logs:Unmask permission.
interleaved : interleaved option;If the value is true, the operation attempts to provide responses that contain events from multiple log streams within the log group, interleaved in a single response. If the value is false, all the matched log events in the first log stream are searched first, then those in the next log stream, and so on.
Important As of June 17, 2019, this parameter is ignored and the value is assumed to be true. The response from this operation always interleaves events from multiple log streams within a log group.
*)start_from_head : start_from_head option;If the value is true, the earliest log events are returned first. If the value is false, the latest log events are returned first. The default value is true.
The startFromHead parameter sets the sort direction on the first request. On subsequent requests, the nextToken determines the sort direction. To continue paginating in the same direction, provide the returned nextToken. If you provide both nextToken and startFromHead, the direction of the nextToken is used.
Setting startFromHead to false is supported only when startTime is on or after Jan 1, 2024 00:00:00 UTC. A request with startFromHead set to false and a startTime before this date returns an InvalidParameterException.
limit : events_limit option;The maximum number of events to return. The default is 10,000 events.
*)next_token : next_token option;The token for the next set of events to return. (You received this token from a previous call.)
*)filter_pattern : filter_pattern option;The filter pattern to use. For more information, see Filter and Pattern Syntax.
If not provided, all the events are matched.
*)end_time : timestamp option;The end of the time range, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Events with a timestamp later than this time are not returned.
start_time : timestamp option;The start of the time range, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Events with a timestamp before this time are not returned.
log_stream_name_prefix : log_stream_name option;Filters the results to include only events from log streams that have names starting with this prefix.
If you specify a value for both logStreamNamePrefix and logStreamNames, the action returns an InvalidParameterException error.
log_stream_names : input_log_stream_names option;Filters the results to only logs from the log streams in this list.
If you specify a value for both logStreamNames and logStreamNamePrefix, the action returns an InvalidParameterException error.
log_group_identifier : log_group_identifier option;Specify either the name or ARN of the log group to view log events from. If the log group is in a source account and you are using a monitoring account, you must use the log group ARN.
You must include either logGroupIdentifier or logGroupName, but not both.
log_group_name : log_group_name option;The name of the log group to search.
You must include either logGroupIdentifier or logGroupName, but not both.
}type nonrec disassociate_source_from_s3_table_integration_response = {identifier : s3_table_integration_source_identifier option;The unique identifier of the association that was removed.
*)}type nonrec disassociate_source_from_s3_table_integration_request = {identifier : s3_table_integration_source_identifier;The unique identifier of the association to remove between the data source and S3 Table Integration.
*)}type nonrec disassociate_kms_key_request = {resource_identifier : resource_identifier option;Specifies the target for this operation. You must specify one of the following:
Specify the ARN of a log group to stop having CloudWatch Logs use the KMS key to encrypt log events that are ingested and stored by that log group. After you run this operation, CloudWatch Logs encrypts ingested log events with the default CloudWatch Logs method. The log group ARN must be in the following format. Replace REGION and ACCOUNT_ID with your Region and account ID.
arn:aws:logs:{i REGION}:{i ACCOUNT_ID}:log-group:{i LOG_GROUP_NAME} Specify the following ARN to stop using this key to encrypt the results of future StartQuery operations in this account. Replace REGION and ACCOUNT_ID with your Region and account ID.
arn:aws:logs:{i REGION}:{i ACCOUNT_ID}:query-result:*In your DisssociateKmsKey operation, you must specify either the resourceIdentifier parameter or the logGroup parameter, but you can't specify both.
log_group_name : log_group_name option;The name of the log group.
In your DisassociateKmsKey operation, you must specify either the resourceIdentifier parameter or the logGroup parameter, but you can't specify both.
}type nonrec describe_subscription_filters_response = {next_token : next_token option;subscription_filters : subscription_filters option;The subscription filters.
*)}type nonrec describe_subscription_filters_request = {limit : describe_limit option;The maximum number of items returned. If you don't specify a value, the default is up to 50 items.
*)next_token : next_token option;The token for the next set of items to return. (You received this token from a previous call.)
*)filter_name_prefix : filter_name option;The prefix to match. If you don't specify a value, no prefix filter is applied.
*)log_group_name : log_group_name;The name of the log group.
*)}type nonrec describe_resource_policies_response = {next_token : next_token option;resource_policies : resource_policies option;The resource policies that exist in this account.
*)}type nonrec describe_resource_policies_request = {policy_scope : policy_scope option;Specifies the scope of the resource policy. Valid values are ACCOUNT or RESOURCE. When not specified, defaults to ACCOUNT.
resource_arn : arn option;The ARN of the CloudWatch Logs resource for which to query the resource policy.
*)limit : describe_limit option;The maximum number of resource policies to be displayed with one call of this API.
*)next_token : next_token option;}type nonrec describe_query_definitions_response = {next_token : next_token option;query_definitions : query_definition_list option;The list of query definitions that match your request.
*)}type nonrec describe_query_definitions_request = {next_token : next_token option;max_results : query_list_max_results option;Limits the number of returned query definitions to the specified number.
*)query_definition_name_prefix : query_definition_name option;Use this parameter to filter your results to only the query definitions that have names that start with the prefix you specify.
*)query_language : query_language option;The query language used for this query. For more information about the query languages that CloudWatch Logs supports, see Supported query languages.
*)}type nonrec describe_queries_response = {next_token : next_token option;queries : query_info_list option;The list of queries that match the request.
*)}type nonrec describe_queries_request = {query_language : query_language option;Limits the returned queries to only the queries that use the specified query language.
*)next_token : next_token option;max_results : describe_queries_max_results option;Limits the number of returned queries to the specified number.
*)status : query_status option;Limits the returned queries to only those that have the specified status. Valid values are Cancelled, Complete, Failed, Running, and Scheduled.
log_group_name : log_group_name option;Limits the returned queries to only those for the specified log group.
*)}type nonrec describe_metric_filters_response = {next_token : next_token option;metric_filters : metric_filters option;The metric filters.
*)}type nonrec describe_metric_filters_request = {metric_namespace : metric_namespace option;Filters results to include only those in the specified namespace. If you include this parameter in your request, you must also include the metricName parameter.
metric_name : metric_name option;Filters results to include only those with the specified metric name. If you include this parameter in your request, you must also include the metricNamespace parameter.
limit : describe_limit option;The maximum number of items returned. If you don't specify a value, the default is up to 50 items.
*)next_token : next_token option;The token for the next set of items to return. (You received this token from a previous call.)
*)filter_name_prefix : filter_name option;The prefix to match. CloudWatch Logs uses the value that you set here only if you also include the logGroupName parameter in your request.
log_group_name : log_group_name option;The name of the log group.
*)}type nonrec describe_lookup_tables_response = {next_token : next_token option;The token to use when requesting the next set of items.
*)lookup_tables : lookup_tables option;An array of structures, where each structure contains metadata about one lookup table.
*)}type nonrec describe_lookup_tables_request = {next_token : next_token option;The token for the next set of items to return. (You received this token from a previous call.)
*)max_results : describe_lookup_tables_max_results option;The maximum number of lookup tables to return in the response. The default value is 50 and the maximum value is 100.
*)lookup_table_name_prefix : lookup_table_name option;A prefix to filter lookup tables by name. Only tables whose names start with this prefix are returned. If you don't specify a prefix, all tables in the account and Region are returned.
*)}type nonrec log_stream = {stored_bytes : stored_bytes option;The number of bytes stored.
Important: As of June 17, 2019, this parameter is no longer supported for log streams, and is always reported as zero. This change applies only to log streams. The storedBytes parameter for log groups is not affected.
arn : arn option;The Amazon Resource Name (ARN) of the log stream.
*)upload_sequence_token : sequence_token option;The sequence token.
The sequence token is now ignored in PutLogEvents actions. PutLogEvents actions are always accepted regardless of receiving an invalid sequence token. You don't need to obtain uploadSequenceToken to use a PutLogEvents action.
last_ingestion_time : timestamp option;The ingestion time, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC The lastIngestionTime value updates on an eventual consistency basis. It typically updates in less than an hour after ingestion, but in rare situations might take longer.
last_event_timestamp : timestamp option;The time of the most recent log event in the log stream in CloudWatch Logs. This number is expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. The lastEventTime value updates on an eventual consistency basis. It typically updates in less than an hour from ingestion, but in rare situations might take longer.
first_event_timestamp : timestamp option;The time of the first event, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
creation_time : timestamp option;The creation time of the stream, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
log_stream_name : log_stream_name option;The name of the log stream.
*)}Represents a log stream, which is a sequence of log events from a single emitter of logs.
type nonrec log_streams = log_stream listtype nonrec describe_log_streams_response = {next_token : next_token option;log_streams : log_streams option;The log streams.
*)}type nonrec describe_log_streams_request = {limit : describe_limit option;The maximum number of items returned. If you don't specify a value, the default is up to 50 items.
*)next_token : next_token option;The token for the next set of items to return. (You received this token from a previous call.)
*)descending : descending option;If the value is true, results are returned in descending order. If the value is to false, results are returned in ascending order. The default value is false.
*)order_by : order_by option;If the value is LogStreamName, the results are ordered by log stream name. If the value is LastEventTime, the results are ordered by the event time. The default value is LogStreamName.
If you order the results by event time, you cannot specify the logStreamNamePrefix parameter.
lastEventTimestamp represents the time of the most recent log event in the log stream in CloudWatch Logs. This number is expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. lastEventTimestamp updates on an eventual consistency basis. It typically updates in less than an hour from ingestion, but in rare situations might take longer.
log_stream_name_prefix : log_stream_name option;The prefix to match.
If orderBy is LastEventTime, you cannot specify this parameter.
log_group_identifier : log_group_identifier option;Specify either the name or ARN of the log group to view. If the log group is in a source account and you are using a monitoring account, you must use the log group ARN.
You must include either logGroupIdentifier or logGroupName, but not both.
log_group_name : log_group_name option;The name of the log group.
You must include either logGroupIdentifier or logGroupName, but not both.
}type nonrec inherited_properties = inherited_property listtype nonrec log_group = {bearer_token_authentication_enabled : bearer_token_authentication_enabled
option;Indicates whether bearer token authentication is enabled for this log group. When enabled, bearer token authentication is allowed on operations until it is explicitly disabled.
*)deletion_protection_enabled : deletion_protection_enabled option;Indicates whether deletion protection is enabled for this log group. When enabled, deletion protection blocks all deletion operations until it is explicitly disabled.
*)log_group_arn : arn option;The Amazon Resource Name (ARN) of the log group. This version of the ARN doesn't include a trailing :* after the log group name.
Use this version to refer to the ARN in the following situations:
logGroupIdentifier input field in many CloudWatch Logs APIs.resourceArn field in tagging APIslog_group_class : log_group_class option;This specifies the log group class for this log group. There are three classes:
Standard log class supports all CloudWatch Logs features.Infrequent Access log class supports a subset of CloudWatch Logs features and incurs lower costs.Delivery log class only for delivering Lambda logs to store in Amazon S3 or Amazon Data Firehose. Log events in log groups in the Delivery class are kept in CloudWatch Logs for only one day. This log class doesn't offer rich CloudWatch Logs capabilities such as CloudWatch Logs Insights queries.For details about the features supported by the Standard and Infrequent Access classes, see Log classes
*)inherited_properties : inherited_properties option;Displays all the properties that this log group has inherited from account-level settings.
*)data_protection_status : data_protection_status option;Displays whether this log group has a protection policy, or whether it had one in the past. For more information, see PutDataProtectionPolicy.
*)kms_key_id : kms_key_id option;The Amazon Resource Name (ARN) of the KMS key to use when encrypting log data.
*)stored_bytes : stored_bytes option;The number of bytes stored.
*)arn : arn option;The Amazon Resource Name (ARN) of the log group. This version of the ARN includes a trailing :* after the log group name.
Use this version to refer to the ARN in IAM policies when specifying permissions for most API actions. The exception is when specifying permissions for TagResource, UntagResource, and ListTagsForResource. The permissions for those three actions require the ARN version that doesn't include a trailing :*.
metric_filter_count : filter_count option;The number of metric filters.
*)retention_in_days : days option;creation_time : timestamp option;The creation time of the log group, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
*)log_group_name : log_group_name option;The name of the log group.
*)}Represents a log group.
type nonrec log_groups = log_group listtype nonrec describe_log_groups_response = {next_token : next_token option;log_groups : log_groups option;An array of structures, where each structure contains the information about one log group.
*)}type nonrec describe_log_groups_log_group_identifiers =
log_group_identifier listtype nonrec describe_log_groups_request = {log_group_identifiers : describe_log_groups_log_group_identifiers option;Use this array to filter the list of log groups returned. If you specify this parameter, the only other filter that you can choose to specify is includeLinkedAccounts.
If you are using this operation in a monitoring account, you can specify the ARNs of log groups in source accounts and in the monitoring account itself. If you are using this operation in an account that is not a cross-account monitoring account, you can specify only log group names in the same account as the operation.
*)log_group_class : log_group_class option;Use this parameter to limit the results to only those log groups in the specified log group class. If you omit this parameter, log groups of all classes can be returned.
Specifies the log group class for this log group. There are three classes:
Standard log class supports all CloudWatch Logs features.Infrequent Access log class supports a subset of CloudWatch Logs features and incurs lower costs.Delivery log class only for delivering Lambda logs to store in Amazon S3 or Amazon Data Firehose. Log events in log groups in the Delivery class are kept in CloudWatch Logs for only one day. This log class doesn't offer rich CloudWatch Logs capabilities such as CloudWatch Logs Insights queries.For details about the features supported by each class, see Log classes
*)include_linked_accounts : include_linked_accounts option;If you are using a monitoring account, set this to true to have the operation return log groups in the accounts listed in accountIdentifiers.
If this parameter is set to true and accountIdentifiers contains a null value, the operation returns all log groups in the monitoring account and all log groups in all source accounts that are linked to the monitoring account.
The default for this parameter is false.
limit : describe_limit option;The maximum number of items returned. If you don't specify a value, the default is up to 50 items.
*)next_token : next_token option;The token for the next set of items to return. (You received this token from a previous call.)
*)log_group_name_pattern : log_group_name_pattern option;If you specify a string for this parameter, the operation returns only log groups that have names that match the string based on a case-sensitive substring search. For example, if you specify DataLogs, log groups named DataLogs, aws/DataLogs, and GroupDataLogs would match, but datalogs, Data/log/s and Groupdata would not match.
If you specify logGroupNamePattern in your request, then only arn, creationTime, and logGroupName are included in the response.
logGroupNamePattern and logGroupNamePrefix are mutually exclusive. Only one of these parameters can be passed.
log_group_name_prefix : log_group_name option;The prefix to match.
logGroupNamePrefix and logGroupNamePattern are mutually exclusive. Only one of these parameters can be passed.
account_identifiers : account_ids option;When includeLinkedAccounts is set to true, use this parameter to specify the list of accounts to search. You can specify as many as 20 account IDs in the array.
}type nonrec index_policies = index_policy listtype nonrec describe_index_policies_response = {next_token : next_token option;index_policies : index_policies option;An array containing the field index policies.
*)}type nonrec describe_index_policies_log_group_identifiers =
log_group_identifier listtype nonrec describe_index_policies_request = {next_token : next_token option;log_group_identifiers : describe_index_policies_log_group_identifiers;An array containing the name or ARN of the log group that you want to retrieve field index policies for.
*)}type nonrec import_statistics = {bytes_imported : stored_bytes option;The total number of bytes that have been imported to the managed log group.
*)}Statistics about the import progress
type nonrec import_filter = {end_event_time : timestamp option;The end of the time range for events to import, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
*)start_event_time : timestamp option;The start of the time range for events to import, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
*)}The filter criteria used for import tasks
type nonrec import = {error_message : error_message option;Error message related to any failed imports
*)last_updated_time : timestamp option;The timestamp when the import task was last updated, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
*)creation_time : timestamp option;The timestamp when the import task was created, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
*)import_filter : import_filter option;The filter criteria used for this import task.
*)import_statistics : import_statistics option;Statistics about the import progress
*)import_destination_arn : arn option;The ARN of the managed CloudWatch Logs log group where the events are being imported to.
*)import_status : import_status option;The current status of the import task. Valid values are IN_PROGRESS, CANCELLED, COMPLETED and FAILED.
*)import_source_arn : arn option;The ARN of the CloudTrail Lake Event Data Store being imported from.
*)import_id : import_id option;The unique identifier of the import task.
*)}An import job to move data from CloudTrail Event Data Store to CloudWatch.
type nonrec import_list = import listtype nonrec describe_import_tasks_response = {next_token : next_token option;The token to use when requesting the next set of results. Not present if there are no additional results to retrieve.
*)imports : import_list option;The list of import tasks that match the request filters.
*)}type nonrec describe_import_tasks_request = {next_token : next_token option;The pagination token for the next set of results.
*)limit : describe_limit option;The maximum number of import tasks to return in the response. Default: 50
*)import_source_arn : arn option;Optional filter to list imports from a specific source
*)import_status : import_status option;Optional filter to list imports by their status. Valid values are IN_PROGRESS, CANCELLED, COMPLETED and FAILED.
*)import_id : import_id option;Optional filter to describe a specific import task by its ID.
*)}type nonrec import_batch = {error_message : error_message option;The error message if the batch failed to import. Only present when status is FAILED.
*)status : import_status;The current status of the import batch. Valid values are IN_PROGRESS, CANCELLED, COMPLETED and FAILED.
*)batch_id : batch_id;The unique identifier of the import batch.
*)}A collection of events being imported to CloudWatch
type nonrec import_batch_list = import_batch listtype nonrec describe_import_task_batches_response = {next_token : next_token option;The token to use when requesting the next set of results. Not present if there are no additional results to retrieve.
*)import_batches : import_batch_list option;The list of import batches that match the request filters.
*)import_id : import_id option;The ID of the import task.
*)import_source_arn : arn option;The ARN of the source being imported from.
*)}type nonrec import_status_list = import_status listtype nonrec describe_import_task_batches_request = {next_token : next_token option;The pagination token for the next set of results.
*)limit : describe_limit option;The maximum number of import batches to return in the response. Default: 10
*)batch_import_status : import_status_list option;Optional filter to list import batches by their status. Accepts multiple status values: IN_PROGRESS, CANCELLED, COMPLETED and FAILED.
*)import_id : import_id;The ID of the import task to get batch information for.
*)}type nonrec field_index = {type_ : index_type option;The type of index. Specify FACET for facet-based indexing or FIELD_INDEX for field-based indexing. This determines how the field is indexed and can be queried.
last_event_time : timestamp option;The time and date of the most recent log event that matches this field index.
*)first_event_time : timestamp option;The time and date of the earliest log event that matches this field index, after the index policy that contains it was created.
*)last_scan_time : timestamp option;The most recent time that CloudWatch Logs scanned ingested log events to search for this field index to improve the speed of future CloudWatch Logs Insights queries that search for this field index.
*)field_index_name : field_index_name option;The string that this field index matches.
*)log_group_identifier : log_group_identifier option;If this field index appears in an index policy that applies only to a single log group, the ARN of that log group is displayed here.
*)}This structure describes one log event field that is used as an index in at least one index policy in this account.
type nonrec field_indexes = field_index listtype nonrec describe_field_indexes_response = {next_token : next_token option;field_indexes : field_indexes option;An array containing the field index information.
*)}type nonrec describe_field_indexes_log_group_identifiers =
log_group_identifier listtype nonrec describe_field_indexes_request = {next_token : next_token option;log_group_identifiers : describe_field_indexes_log_group_identifiers;An array containing the names or ARNs of the log groups that you want to retrieve field indexes for.
*)}type nonrec export_task_status = {message : export_task_status_message option;The status message related to the status code.
*)code : export_task_status_code option;The status code of the export task.
*)}Represents the status of an export task.
type nonrec export_task_execution_info = {completion_time : timestamp option;The completion time of the export task, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
creation_time : timestamp option;The creation time of the export task, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
}Represents the status of an export task.
type nonrec export_task = {execution_info : export_task_execution_info option;Execution information about the export task.
*)status : export_task_status option;The status of the export task.
*)destination_prefix : export_destination_prefix option;The prefix that was used as the start of Amazon S3 key for every object exported.
*)destination : export_destination_bucket option;The name of the S3 bucket to which the log data was exported.
*)to_ : timestamp option;The end time, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Events with a timestamp later than this time are not exported.
from_ : timestamp option;The start time, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Events with a timestamp before this time are not exported.
log_group_name : log_group_name option;The name of the log group from which logs data was exported.
*)task_name : export_task_name option;The name of the export task.
*)task_id : export_task_id option;The ID of the export task.
*)}Represents an export task.
type nonrec export_tasks = export_task listtype nonrec describe_export_tasks_response = {next_token : next_token option;export_tasks : export_tasks option;The export tasks.
*)}type nonrec describe_export_tasks_request = {limit : describe_limit option;The maximum number of items returned. If you don't specify a value, the default is up to 50 items.
*)next_token : next_token option;The token for the next set of items to return. (You received this token from a previous call.)
*)status_code : export_task_status_code option;The status code of the export task. Specifying a status code filters the results to zero or more export tasks.
*)task_id : export_task_id option;The ID of the export task. Specifying a task ID filters the results to one or zero export tasks.
*)}type nonrec destinations = destination listtype nonrec describe_destinations_response = {next_token : next_token option;destinations : destinations option;The destinations.
*)}type nonrec describe_destinations_request = {limit : describe_limit option;The maximum number of items returned. If you don't specify a value, the default maximum value of 50 items is used.
*)next_token : next_token option;The token for the next set of items to return. (You received this token from a previous call.)
*)destination_name_prefix : destination_name option;The prefix to match. If you don't specify a value, no prefix filter is applied.
*)}type nonrec delivery_sources = delivery_source listtype nonrec describe_delivery_sources_response = {next_token : next_token option;delivery_sources : delivery_sources option;An array of structures. Each structure contains information about one delivery source in the account.
*)}type nonrec describe_delivery_sources_request = {limit : describe_limit option;Optionally specify the maximum number of delivery sources to return in the response.
*)next_token : next_token option;}type nonrec delivery_destinations = delivery_destination listtype nonrec describe_delivery_destinations_response = {next_token : next_token option;delivery_destinations : delivery_destinations option;An array of structures. Each structure contains information about one delivery destination in the account.
*)}type nonrec describe_delivery_destinations_request = {limit : describe_limit option;Optionally specify the maximum number of delivery destinations to return in the response.
*)next_token : next_token option;}type nonrec deliveries = delivery listtype nonrec describe_deliveries_response = {next_token : next_token option;deliveries : deliveries option;An array of structures. Each structure contains information about one delivery in the account.
*)}type nonrec describe_deliveries_request = {limit : describe_limit option;Optionally specify the maximum number of deliveries to return in the response.
*)next_token : next_token option;}type nonrec configuration_template_delivery_config_values = {s3_delivery_configuration : s3_delivery_configuration option;The delivery parameters that are used when you create a delivery to a delivery destination that is an S3 Bucket.
*)field_delimiter : field_delimiter option;The default field delimiter that is used in a CreateDelivery operation when the field delimiter is not specified in that operation. The field delimiter is used only when the final output delivery is in Plain, W3C, or Raw format.
record_fields : record_fields option;The default record fields that will be delivered when a list of record fields is not provided in a CreateDelivery operation.
*)}This structure contains the default values that are used for each configuration parameter when you use CreateDelivery to create a deliver under the current service type, resource type, and log type.
type nonrec allowed_fields = record_field listtype nonrec allowed_field_delimiters = field_delimiter listtype nonrec delivery_source_configuration_supported_values =
delivery_source_configuration_schema_field listtype nonrec delivery_source_configuration_schema = {max_value : delivery_source_configuration_numeric_value option;The maximum numeric value allowed for the configuration. This applies only when the valueType is a numeric type.
min_value : delivery_source_configuration_numeric_value option;The minimum numeric value allowed for the configuration. This applies only when the valueType is a numeric type.
supported_values : delivery_source_configuration_supported_values option;The list of allowed values for the configuration. Empty for free-form configuration.
*)default_value : delivery_source_configuration_schema_field;The default value of the configuration that is used when a value is not specified in a PutDeliverySource request.
*)value_type : delivery_source_configuration_schema_value_type;The data type of the configuration value. Valid values are string, boolean, int, double, and long.
key_name : delivery_source_configuration_schema_field;The name of the configuration.
*)}A structure that describes a single configuration for a log type, including its name, value type, default value, and the range of supported values.
type nonrec delivery_source_configuration_schemas =
delivery_source_configuration_schema listtype nonrec configuration_template = {s3_tables_integration : s3_tables_integration option;The S3 Tables integration configuration for this configuration template, including the datasource name and type.
*)delivery_source_configuration : delivery_source_configuration_schemas option;The schema of the delivery source configuration that is available for this log type. Each element describes a configuration that can be set when calling PutDeliverySource, including the configuration name, type, and default value.
*)allowed_suffix_path_fields : record_fields option;The list of variable fields that can be used in the suffix path of a delivery that delivers to an S3 bucket.
*)allowed_field_delimiters : allowed_field_delimiters option;The valid values that a caller can use as field delimiters when calling CreateDelivery or UpdateDeliveryConfiguration on a delivery that delivers in Plain, W3C, or Raw format.
allowed_action_for_allow_vended_logs_delivery_for_resource : allowed_action_for_allow_vended_logs_delivery_for_resource
option;The action permissions that a caller needs to have to be able to successfully create a delivery source on the desired resource type when calling PutDeliverySource.
*)allowed_output_formats : output_formats option;The list of delivery destination output formats that are supported by this log source.
*)allowed_fields : allowed_fields option;The allowed fields that a caller can use in the recordFields parameter of a CreateDelivery or UpdateDeliveryConfiguration operation.
default_delivery_config_values : configuration_template_delivery_config_values
option;A mapping that displays the default value of each property within a delivery's configuration, if it is not specified in the request.
*)delivery_destination_type : delivery_destination_type option;A string specifying which destination type this configuration template applies to.
*)resource_type : resource_type option;A string specifying which resource type this configuration template applies to.
*)log_type : log_type option;A string specifying which log type this configuration template applies to.
*)service : service option;A string specifying which service this configuration template applies to. For more information about supported services see Enable logging from Amazon Web Services services..
*)}A structure containing information about the deafult settings and available settings that you can use to configure a delivery or a delivery destination.
type nonrec configuration_templates = configuration_template listtype nonrec describe_configuration_templates_response = {next_token : next_token option;configuration_templates : configuration_templates option;An array of objects, where each object describes one configuration template that matches the filters that you specified in the request.
*)}type nonrec log_types = log_type listtype nonrec delivery_destination_types = delivery_destination_type listtype nonrec describe_configuration_templates_request = {limit : describe_limit option;Use this parameter to limit the number of configuration templates that are returned in the response.
*)next_token : next_token option;delivery_destination_types : delivery_destination_types option;Use this parameter to filter the response to include only the configuration templates that apply to the delivery destination types that you specify here.
*)resource_types : resource_types option;Use this parameter to filter the response to include only the configuration templates that apply to the resource types that you specify here.
*)log_types : log_types option;Use this parameter to filter the response to include only the configuration templates that apply to the log types that you specify here.
*)service : service option;Use this parameter to filter the response to include only the configuration templates that apply to the Amazon Web Services service that you specify here.
*)}type nonrec account_policies = account_policy listtype nonrec describe_account_policies_response = {next_token : next_token option;The token to use when requesting the next set of items. The token expires after 24 hours.
*)account_policies : account_policies option;An array of structures that contain information about the CloudWatch Logs account policies that match the specified filters.
*)}type nonrec describe_account_policies_request = {next_token : next_token option;The token for the next set of items to return. (You received this token from a previous call.)
*)account_identifiers : account_ids option;If you are using an account that is set up as a monitoring account for CloudWatch unified cross-account observability, you can use this to specify the account ID of a source account. If you do, the operation returns the account policy for the specified account. Currently, you can specify only one account ID in this parameter.
If you omit this parameter, only the policy in the current account is returned.
*)policy_name : policy_name option;Use this parameter to limit the returned policies to only the policy with the name that you specify.
*)policy_type : policy_type;Use this parameter to limit the returned policies to only the policies that match the policy type that you specify.
*)}type nonrec delete_transformer_request = {log_group_identifier : log_group_identifier;Specify either the name or ARN of the log group to delete the transformer for. If the log group is in a source account and you are using a monitoring account, you must use the log group ARN.
*)}type nonrec delete_syslog_configuration_request = {vpc_endpoint_id : vpc_endpoint_id option;The ID of the VPC endpoint associated with the syslog configuration to delete.
*)log_group_identifier : log_group_identifier;The name or ARN of the log group to remove the syslog configuration from.
*)}type nonrec delete_subscription_filter_request = {filter_name : filter_name;The name of the subscription filter.
*)log_group_name : log_group_name;The name of the log group.
*)}type nonrec delete_scheduled_query_request = {identifier : scheduled_query_identifier;The ARN or name of the scheduled query to delete.
*)}type nonrec delete_retention_policy_request = {log_group_name : log_group_name;The name of the log group.
*)}type nonrec delete_resource_policy_request = {expected_revision_id : expected_revision_id option;The expected revision ID of the resource policy. Required when deleting a resource-scoped policy to prevent concurrent modifications.
*)resource_arn : arn option;The ARN of the CloudWatch Logs resource for which the resource policy needs to be deleted
*)policy_name : policy_name option;The name of the policy to be revoked. This parameter is required.
*)}type nonrec delete_query_definition_response = {success : success option;A value of TRUE indicates that the operation succeeded. FALSE indicates that the operation failed.
*)}type nonrec delete_query_definition_request = {query_definition_id : query_id;The ID of the query definition that you want to delete. You can use DescribeQueryDefinitions to retrieve the IDs of your saved query definitions.
*)}type nonrec delete_metric_filter_request = {filter_name : filter_name;The name of the metric filter.
*)log_group_name : log_group_name;The name of the log group.
*)}type nonrec delete_lookup_table_request = {lookup_table_arn : arn;The ARN of the lookup table to delete.
*)}type nonrec delete_log_stream_request = {log_stream_name : log_stream_name;The name of the log stream.
*)log_group_name : log_group_name;The name of the log group.
*)}type nonrec delete_log_group_request = {log_group_name : log_group_name;The name of the log group.
*)}type nonrec delete_log_anomaly_detector_request = {anomaly_detector_arn : anomaly_detector_arn;The ARN of the anomaly detector to delete. You can find the ARNs of log anomaly detectors in your account by using the ListLogAnomalyDetectors operation.
*)}type nonrec delete_integration_request = {force : force option;Specify true to force the deletion of the integration even if vended logs dashboards currently exist.
The default is false.
integration_name : integration_name;The name of the integration to delete. To find the name of your integration, use ListIntegrations.
*)}type nonrec delete_index_policy_request = {log_group_identifier : log_group_identifier;The log group to delete the index policy for. You can specify either the name or the ARN of the log group.
*)}type nonrec delete_destination_request = {destination_name : destination_name;The name of the destination.
*)}type nonrec delete_delivery_source_request = {name : delivery_source_name;The name of the delivery source that you want to delete.
*)}type nonrec delete_delivery_destination_policy_request = {delivery_destination_name : delivery_destination_name;The name of the delivery destination that you want to delete the policy for.
*)}type nonrec delete_delivery_destination_request = {name : delivery_destination_name;The name of the delivery destination that you want to delete. You can find a list of delivery destination names by using the DescribeDeliveryDestinations operation.
*)}type nonrec delete_delivery_request = {id : delivery_id;The unique ID of the delivery to delete. You can find the ID of a delivery with the DescribeDeliveries operation.
*)}type nonrec delete_data_protection_policy_request = {log_group_identifier : log_group_identifier;The name or ARN of the log group that you want to delete the data protection policy for.
*)}type nonrec delete_account_policy_request = {policy_type : policy_type;The type of policy to delete.
*)policy_name : policy_name;The name of the policy to delete.
*)}type nonrec create_scheduled_query_response = {state : scheduled_query_state option;The current state of the scheduled query.
*)scheduled_query_arn : arn option;The ARN of the created scheduled query.
*)}type nonrec create_scheduled_query_request = {state : scheduled_query_state option;The initial state of the scheduled query. Valid values are ENABLED and DISABLED. Default is ENABLED.
execution_role_arn : role_arn;The ARN of the IAM role that grants permissions to execute the query and deliver results to the specified destination. The role must have permissions to read from the specified log groups and write to the destination.
*)schedule_end_time : timestamp option;The end time for the scheduled query in Unix epoch format. The query will stop executing after this time.
*)schedule_start_time : timestamp option;The start time for the scheduled query in Unix epoch format. The query will not execute before this time.
*)destination_configuration : destination_configuration option;Configuration for where to deliver query results. Currently supports Amazon S3 destinations for storing query output.
*)end_time_offset : end_time_offset option;The time offset in seconds that defines the end of the lookback period for the query. Together with startTimeOffset, this determines the time window relative to the execution time over which the query runs.
start_time_offset : start_time_offset option;The time offset in seconds that defines the lookback period for the query. This determines how far back in time the query searches from the execution time.
*)timezone : schedule_timezone option;The timezone for evaluating the schedule expression. This determines when the scheduled query executes relative to the specified timezone.
*)schedule_expression : schedule_expression;A cron expression that defines when the scheduled query runs. The expression uses standard cron syntax and supports minute-level precision. Maximum length is 256 characters.
*)log_group_identifiers : scheduled_query_log_group_identifiers option;An array of log group names or ARNs to query. You can specify between 1 and 50 log groups. Log groups can be identified by name or full ARN.
*)query_string : query_string;The query string to execute. This is the same query syntax used in CloudWatch Logs Insights. Maximum length is 10,000 characters.
*)query_language : query_language;The query language to use for the scheduled query. Valid values are CWLI, PPL, and SQL.
description : scheduled_query_description option;An optional description for the scheduled query to help identify its purpose and functionality.
*)name : scheduled_query_name;The name of the scheduled query. The name must be unique within your account and region. Length must be between 1 and 300 characters.
*)}type nonrec create_lookup_table_request = {kms_key_id : kms_key_id option;The ARN of the KMS key to use to encrypt the lookup table data. If you don't specify a key, the data is encrypted with an Amazon Web Services-owned key.
*)table_body : table_body;The CSV content of the lookup table. The first row must be a header row with column names. The content must use UTF-8 encoding and not exceed 10 MB.
*)description : lookup_table_description option;A description of the lookup table. The description can be up to 1024 characters long.
*)lookup_table_name : lookup_table_name;The name of the lookup table. The name must be unique within your account and Region. The name can contain only alphanumeric characters and underscores, and can be up to 256 characters long.
*)}type nonrec create_log_stream_request = {log_stream_name : log_stream_name;The name of the log stream.
*)log_group_name : log_group_name;The name of the log group.
*)}type nonrec create_log_group_request = {deletion_protection_enabled : deletion_protection_enabled option;Use this parameter to enable deletion protection for the new log group. When enabled on a log group, deletion protection blocks all deletion operations until it is explicitly disabled. By default log groups are created without deletion protection enabled.
*)log_group_class : log_group_class option;Use this parameter to specify the log group class for this log group. There are three classes:
Standard log class supports all CloudWatch Logs features.Infrequent Access log class supports a subset of CloudWatch Logs features and incurs lower costs.Delivery log class only for delivering Lambda logs to store in Amazon S3 or Amazon Data Firehose. Log events in log groups in the Delivery class are kept in CloudWatch Logs for only one day. This log class doesn't offer rich CloudWatch Logs capabilities such as CloudWatch Logs Insights queries.If you omit this parameter, the default of STANDARD is used.
The value of logGroupClass can't be changed after a log group is created.
For details about the features supported by each class, see Log classes
*)kms_key_id : kms_key_id option;The Amazon Resource Name (ARN) of the KMS key to use when encrypting log data. For more information, see Amazon Resource Names.
*)log_group_name : log_group_name;A name for the log group.
*)}type nonrec create_log_anomaly_detector_response = {anomaly_detector_arn : anomaly_detector_arn option;The ARN of the log anomaly detector that you just created.
*)}type nonrec create_log_anomaly_detector_request = {anomaly_visibility_time : anomaly_visibility_time option;The number of days to have visibility on an anomaly. After this time period has elapsed for an anomaly, it will be automatically baselined and the anomaly detector will treat new occurrences of a similar anomaly as normal. Therefore, if you do not correct the cause of an anomaly during the time period specified in anomalyVisibilityTime, it will be considered normal going forward and will not be detected as an anomaly.
kms_key_id : detector_kms_key_arn option;Optionally assigns a KMS key to secure this anomaly detector and its findings. If a key is assigned, the anomalies found and the model used by this detector are encrypted at rest with the key. If a key is assigned to an anomaly detector, a user must have permissions for both this key and for the anomaly detector to retrieve information about the anomalies that it finds.
Make sure the value provided is a valid KMS key ARN. For more information about using a KMS key and to see the required IAM policy, see Use a KMS key with an anomaly detector.
*)filter_pattern : filter_pattern option;You can use this parameter to limit the anomaly detection model to examine only log events that match the pattern you specify here. For more information, see Filter and Pattern Syntax.
*)evaluation_frequency : evaluation_frequency option;Specifies how often the anomaly detector is to run and look for anomalies. Set this value according to the frequency that the log group receives new logs. For example, if the log group receives new log events every 10 minutes, then 15 minutes might be a good setting for evaluationFrequency .
detector_name : detector_name option;A name for this anomaly detector.
*)log_group_arn_list : log_group_arn_list;An array containing the ARN of the log group that this anomaly detector will watch. You can specify only one log group ARN.
*)}type nonrec create_import_task_response = {creation_time : timestamp option;The timestamp when the import task was created, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
*)import_destination_arn : arn option;The ARN of the CloudWatch Logs log group created as the destination for the imported events.
*)import_id : import_id option;A unique identifier for the import task.
*)}type nonrec create_import_task_request = {import_filter : import_filter option;Optional filters to constrain the import by CloudTrail event time. Times are specified in Unix timestamp milliseconds. The range of data being imported must be within the specified source's retention period.
*)import_role_arn : role_arn;The ARN of the IAM role that grants CloudWatch Logs permission to import from the CloudTrail Lake Event Data Store.
*)import_source_arn : arn;The ARN of the source to import from.
*)}type nonrec create_export_task_response = {task_id : export_task_id option;The ID of the export task.
*)}type nonrec create_export_task_request = {destination_prefix : export_destination_prefix option;The prefix used as the start of the key for every object exported. If you don't specify a value, the default is exportedlogs.
The length of this parameter must comply with the S3 object key name length limits. The object key name is a sequence of Unicode characters with UTF-8 encoding, and can be up to 1,024 bytes.
*)destination : export_destination_bucket;The name of S3 bucket for the exported log data. The bucket must be in the same Amazon Web Services Region.
*)to_ : timestamp;The end time of the range for the request, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Events with a timestamp later than this time are not exported.
You must specify a time that is not earlier than when this log group was created.
*)from_ : timestamp;The start time of the range for the request, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Events with a timestamp earlier than this time are not exported.
log_stream_name_prefix : log_stream_name option;Export only log streams that match the provided prefix. If you don't specify a value, no prefix filter is applied.
*)log_group_name : log_group_name;The name of the log group.
*)task_name : export_task_name option;The name of the export task.
*)}type nonrec create_delivery_response = {delivery : delivery option;A structure that contains information about the delivery that you just created.
*)}type nonrec create_delivery_request = {s3_delivery_configuration : s3_delivery_configuration option;This structure contains parameters that are valid only when the delivery's delivery destination is an S3 bucket.
*)field_delimiter : field_delimiter option;The field delimiter to use between record fields when the final output format of a delivery is in Plain, W3C, or Raw format.
record_fields : record_fields option;The list of record fields to be delivered to the destination, in order. If the delivery's log source has mandatory fields, they must be included in this list.
*)delivery_destination_arn : arn;The ARN of the delivery destination to use for this delivery.
*)delivery_source_name : delivery_source_name;The name of the delivery source to use for this delivery.
*)}type nonrec cancel_import_task_response = {last_updated_time : timestamp option;The timestamp when the import task was cancelled, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
*)creation_time : timestamp option;The timestamp when the import task was created, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
*)import_status : import_status option;The final status of the import task. This will be set to CANCELLED.
*)import_statistics : import_statistics option;Statistics about the import progress at the time of cancellation.
*)import_id : import_id option;The ID of the cancelled import task.
*)}type nonrec cancel_import_task_request = {import_id : import_id;The ID of the import task to cancel.
*)}type nonrec associate_source_to_s3_table_integration_response = {identifier : s3_table_integration_source_identifier option;The unique identifier for the association between the data source and S3 Table Integration.
*)}type nonrec associate_source_to_s3_table_integration_request = {data_source : data_source;The data source to associate with the S3 Table Integration. Contains the name and type of the data source.
*)integration_arn : arn;The Amazon Resource Name (ARN) of the S3 Table Integration to associate the data source with.
*)}type nonrec associate_kms_key_request = {resource_identifier : resource_identifier option;Specifies the target for this operation. You must specify one of the following:
Specify the following ARN to have future GetQueryResults operations in this account encrypt the results with the specified KMS key. Replace REGION and ACCOUNT_ID with your Region and account ID.
arn:aws:logs:{i REGION}:{i ACCOUNT_ID}:query-result:*Specify the ARN of a log group to have CloudWatch Logs use the KMS key to encrypt log events that are ingested and stored by that log group. The log group ARN must be in the following format. Replace REGION and ACCOUNT_ID with your Region and account ID.
arn:aws:logs:{i REGION}:{i ACCOUNT_ID}:log-group:{i LOG_GROUP_NAME} In your AssociateKmsKey operation, you must specify either the resourceIdentifier parameter or the logGroup parameter, but you can't specify both.
kms_key_id : kms_key_id;The Amazon Resource Name (ARN) of the KMS key to use when encrypting log data. This must be a symmetric KMS key. For more information, see Amazon Resource Names and Using Symmetric and Asymmetric Keys.
*)log_group_name : log_group_name option;The name of the log group.
In your AssociateKmsKey operation, you must specify either the resourceIdentifier parameter or the logGroup parameter, but you can't specify both.
}