# Data Types The Amazon CloudWatch Logs API contains several data types that various actions use. This section describes each data type in detail. **Note** The order of each element in a data type structure is not guaranteed. Applications should not assume a particular order. The following data types are supported: + [AccountPolicy](API_AccountPolicy.md) + [AddKeyEntry](API_AddKeyEntry.md) + [AddKeys](API_AddKeys.md) + [AggregateLogGroupSummary](API_AggregateLogGroupSummary.md) + [Anomaly](API_Anomaly.md) + [AnomalyDetector](API_AnomalyDetector.md) + [ConfigurationTemplate](API_ConfigurationTemplate.md) + [ConfigurationTemplateDeliveryConfigValues](API_ConfigurationTemplateDeliveryConfigValues.md) + [CopyValue](API_CopyValue.md) + [CopyValueEntry](API_CopyValueEntry.md) + [CSV](API_CSV.md) + [DataSource](API_DataSource.md) + [DataSourceFilter](API_DataSourceFilter.md) + [DateTimeConverter](API_DateTimeConverter.md) + [DeleteKeys](API_DeleteKeys.md) + [Delivery](API_Delivery.md) + [DeliveryDestination](API_DeliveryDestination.md) + [DeliveryDestinationConfiguration](API_DeliveryDestinationConfiguration.md) + [DeliverySource](API_DeliverySource.md) + [Destination](API_Destination.md) + [DestinationConfiguration](API_DestinationConfiguration.md) + [Entity](API_Entity.md) + [ExportTask](API_ExportTask.md) + [ExportTaskExecutionInfo](API_ExportTaskExecutionInfo.md) + [ExportTaskStatus](API_ExportTaskStatus.md) + [FieldIndex](API_FieldIndex.md) + [FieldsData](API_FieldsData.md) + [FilteredLogEvent](API_FilteredLogEvent.md) + [GetLogObjectResponseStream](API_GetLogObjectResponseStream.md) + [Grok](API_Grok.md) + [GroupingIdentifier](API_GroupingIdentifier.md) + [Import](API_Import.md) + [ImportBatch](API_ImportBatch.md) + [ImportFilter](API_ImportFilter.md) + [ImportStatistics](API_ImportStatistics.md) + [IndexPolicy](API_IndexPolicy.md) + [InputLogEvent](API_InputLogEvent.md) + [IntegrationDetails](API_IntegrationDetails.md) + [IntegrationSummary](API_IntegrationSummary.md) + [ListToMap](API_ListToMap.md) + [LiveTailSessionLogEvent](API_LiveTailSessionLogEvent.md) + [LiveTailSessionMetadata](API_LiveTailSessionMetadata.md) + [LiveTailSessionStart](API_LiveTailSessionStart.md) + [LiveTailSessionUpdate](API_LiveTailSessionUpdate.md) + [LogEvent](API_LogEvent.md) + [LogFieldsListItem](API_LogFieldsListItem.md) + [LogFieldType](API_LogFieldType.md) + [LogGroup](API_LogGroup.md) + [LogGroupField](API_LogGroupField.md) + [LogGroupSummary](API_LogGroupSummary.md) + [LogStream](API_LogStream.md) + [LookupTable](API_LookupTable.md) + [LowerCaseString](API_LowerCaseString.md) + [MetricFilter](API_MetricFilter.md) + [MetricFilterMatchRecord](API_MetricFilterMatchRecord.md) + [MetricTransformation](API_MetricTransformation.md) + [MoveKeyEntry](API_MoveKeyEntry.md) + [MoveKeys](API_MoveKeys.md) + [OpenSearchApplication](API_OpenSearchApplication.md) + [OpenSearchCollection](API_OpenSearchCollection.md) + [OpenSearchDataAccessPolicy](API_OpenSearchDataAccessPolicy.md) + [OpenSearchDataSource](API_OpenSearchDataSource.md) + [OpenSearchEncryptionPolicy](API_OpenSearchEncryptionPolicy.md) + [OpenSearchIntegrationDetails](API_OpenSearchIntegrationDetails.md) + [OpenSearchLifecyclePolicy](API_OpenSearchLifecyclePolicy.md) + [OpenSearchNetworkPolicy](API_OpenSearchNetworkPolicy.md) + [OpenSearchResourceConfig](API_OpenSearchResourceConfig.md) + [OpenSearchResourceStatus](API_OpenSearchResourceStatus.md) + [OpenSearchWorkspace](API_OpenSearchWorkspace.md) + [OutputLogEvent](API_OutputLogEvent.md) + [ParseCloudfront](API_ParseCloudfront.md) + [ParseJSON](API_ParseJSON.md) + [ParseKeyValue](API_ParseKeyValue.md) + [ParsePostgres](API_ParsePostgres.md) + [ParseRoute53](API_ParseRoute53.md) + [ParseToOCSF](API_ParseToOCSF.md) + [ParseVPC](API_ParseVPC.md) + [ParseWAF](API_ParseWAF.md) + [PatternToken](API_PatternToken.md) + [Policy](API_Policy.md) + [Processor](API_Processor.md) + [QueryCompileError](API_QueryCompileError.md) + [QueryCompileErrorLocation](API_QueryCompileErrorLocation.md) + [QueryDefinition](API_QueryDefinition.md) + [QueryInfo](API_QueryInfo.md) + [QueryParameter](API_QueryParameter.md) + [QueryStatistics](API_QueryStatistics.md) + [RecordField](API_RecordField.md) + [RejectedEntityInfo](API_RejectedEntityInfo.md) + [RejectedLogEventsInfo](API_RejectedLogEventsInfo.md) + [RenameKeyEntry](API_RenameKeyEntry.md) + [RenameKeys](API_RenameKeys.md) + [ResourceConfig](API_ResourceConfig.md) + [ResourcePolicy](API_ResourcePolicy.md) + [ResultField](API_ResultField.md) + [S3Configuration](API_S3Configuration.md) + [S3DeliveryConfiguration](API_S3DeliveryConfiguration.md) + [S3TableIntegrationSource](API_S3TableIntegrationSource.md) + [ScheduledQueryDestination](API_ScheduledQueryDestination.md) + [ScheduledQuerySummary](API_ScheduledQuerySummary.md) + [SearchedLogStream](API_SearchedLogStream.md) + [SplitString](API_SplitString.md) + [SplitStringEntry](API_SplitStringEntry.md) + [StartLiveTailResponseStream](API_StartLiveTailResponseStream.md) + [SubscriptionFilter](API_SubscriptionFilter.md) + [SubstituteString](API_SubstituteString.md) + [SubstituteStringEntry](API_SubstituteStringEntry.md) + [SuppressionPeriod](API_SuppressionPeriod.md) + [TransformedLogRecord](API_TransformedLogRecord.md) + [TriggerHistoryRecord](API_TriggerHistoryRecord.md) + [TrimString](API_TrimString.md) + [TypeConverter](API_TypeConverter.md) + [TypeConverterEntry](API_TypeConverterEntry.md) + [UpperCaseString](API_UpperCaseString.md) # AccountPolicy A structure that contains information about one CloudWatch Logs account policy. ## Contents ** accountId ** The AWS account ID that the policy applies to. Type: String Length Constraints: Fixed length of 12. Pattern: `^\d{12}$` Required: No ** lastUpdatedTime ** The date and time that this policy was most recently updated. Type: Long Valid Range: Minimum value of 0. Required: No ** policyDocument ** The policy document for this account policy. The JSON specified in `policyDocument` can be up to 30,720 characters. Type: String Required: No ** policyName ** The name of the account policy. Type: String Required: No ** policyType ** The type of policy for this account policy. Type: String Valid Values: `DATA_PROTECTION_POLICY | SUBSCRIPTION_FILTER_POLICY | FIELD_INDEX_POLICY | TRANSFORMER_POLICY | METRIC_EXTRACTION_POLICY` Required: No ** scope ** The scope of the account policy. Type: String Valid Values: `ALL` Required: No ** selectionCriteria ** The log group selection criteria that is used for this policy. Type: String Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/AccountPolicy) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/AccountPolicy) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/AccountPolicy) # AddKeyEntry This object defines one key that will be added with the [ addKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-addKey) processor. ## Contents ** key ** The key of the new entry to be added to the log event Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** value ** The value of the new entry to be added to the log event Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Required: Yes ** overwriteIfExists ** Specifies whether to overwrite the value if the key already exists in the log event. If you omit this, the default is `false`. Type: Boolean Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/AddKeyEntry) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/AddKeyEntry) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/AddKeyEntry) # AddKeys This processor adds new key-value pairs to the log event. For more information about this processor including examples, see [ addKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-addKeys) in the *CloudWatch Logs User Guide*. ## Contents ** entries ** An array of objects, where each object contains the information about one key to add to the log event. Type: Array of [AddKeyEntry](API_AddKeyEntry.md) objects Array Members: Minimum number of 1 item. Maximum number of 5 items. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/AddKeys) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/AddKeys) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/AddKeys) # AggregateLogGroupSummary Contains an aggregate summary of log groups grouped by data source characteristics, including the count of log groups and their grouping identifiers. ## Contents ** groupingIdentifiers ** An array of key-value pairs that identify the data source characteristics used to group the log groups. The size and content of this array depends on the `groupBy` parameter specified in the request. Type: Array of [GroupingIdentifier](API_GroupingIdentifier.md) objects Required: No ** logGroupCount ** The number of log groups in this aggregate summary group. Type: Integer Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/AggregateLogGroupSummary) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/AggregateLogGroupSummary) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/AggregateLogGroupSummary) # Anomaly This structure represents one anomaly that has been found by a logs anomaly detector. For more information about patterns and anomalies, see [CreateLogAnomalyDetector](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogAnomalyDetector.html). ## Contents ** active ** Specifies whether this anomaly is still ongoing. Type: Boolean Required: Yes ** anomalyDetectorArn ** The ARN of the anomaly detector that identified this anomaly. Type: String Length Constraints: Minimum length of 1. Pattern: `[\w#+=/:,.@-]*` Required: Yes ** anomalyId ** The unique ID that CloudWatch Logs assigned to this anomaly. Type: String Length Constraints: Fixed length of 36. Required: Yes ** description ** A human-readable description of the anomaly. This description is generated by CloudWatch Logs. Type: String Length Constraints: Minimum length of 1. Required: Yes ** firstSeen ** The date and time when the anomaly detector first saw this anomaly. It is specified as epoch time, which is the number of seconds since `January 1, 1970, 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: Yes ** histogram ** A map showing times when the anomaly detector ran, and the number of occurrences of this anomaly that were detected at each of those runs. The times are specified in epoch time, which is the number of seconds since `January 1, 1970, 00:00:00 UTC`. Type: String to long map Key Length Constraints: Minimum length of 1. Required: Yes ** lastSeen ** The date and time when the anomaly detector most recently saw this anomaly. It is specified as epoch time, which is the number of seconds since `January 1, 1970, 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: Yes ** logGroupArnList ** An array of ARNS of the log groups that contained log events considered to be part of this anomaly. Type: Array of strings Length Constraints: Minimum length of 1. Maximum length of 2048. Pattern: `[\w#+=/:,.@-]*` Required: Yes ** logSamples ** An array of sample log event messages that are considered to be part of this anomaly. Type: Array of [LogEvent](API_LogEvent.md) objects Required: Yes ** patternId ** The ID of the pattern used to help identify this anomaly. Type: String Length Constraints: Fixed length of 32. Required: Yes ** patternString ** The pattern used to help identify this anomaly, in string format. Type: String Length Constraints: Minimum length of 1. Required: Yes ** patternTokens ** An array of structures where each structure contains information about one token that makes up the pattern. Type: Array of [PatternToken](API_PatternToken.md) objects Required: Yes ** state ** Indicates the current state of this anomaly. If it is still being treated as an anomaly, the value is `Active`. If you have suppressed this anomaly by using the [UpdateAnomaly](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UpdateAnomaly.html) operation, the value is `Suppressed`. If this behavior is now considered to be normal, the value is `Baseline`. Type: String Valid Values: `Active | Suppressed | Baseline` Required: Yes ** isPatternLevelSuppression ** If this anomaly is suppressed, this field is `true` if the suppression is because the pattern is suppressed. If `false`, then only this particular anomaly is suppressed. Type: Boolean Required: No ** patternRegex ** The pattern used to help identify this anomaly, in regular expression format. Type: String Length Constraints: Minimum length of 1. Required: No ** priority ** The priority level of this anomaly, as determined by CloudWatch Logs. Priority is computed based on log severity labels such as `FATAL` and `ERROR` and the amount of deviation from the baseline. Possible values are `HIGH`, `MEDIUM`, and `LOW`. Type: String Length Constraints: Minimum length of 1. Required: No ** suppressed ** Indicates whether this anomaly is currently suppressed. To suppress an anomaly, use [UpdateAnomaly](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UpdateAnomaly.html). Type: Boolean Required: No ** suppressedDate ** If the anomaly is suppressed, this indicates when it was suppressed. Type: Long Valid Range: Minimum value of 0. Required: No ** suppressedUntil ** If the anomaly is suppressed, this indicates when the suppression will end. If this value is `0`, the anomaly was suppressed with no expiration, with the `INFINITE` value. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/Anomaly) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/Anomaly) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/Anomaly) # AnomalyDetector Contains information about one anomaly detector in the account. ## Contents ** anomalyDetectorArn ** The ARN of the anomaly detector. Type: String Length Constraints: Minimum length of 1. Pattern: `[\w#+=/:,.@-]*` Required: No ** anomalyDetectorStatus ** Specifies the current status of the anomaly detector. To pause an anomaly detector, use the `enabled` parameter in the [UpdateLogAnomalyDetector](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UpdateLogAnomalyDetector.html) operation. Type: String Valid Values: `INITIALIZING | TRAINING | ANALYZING | FAILED | DELETED | PAUSED` Required: No ** anomalyVisibilityTime ** The number of days used as the life cycle of anomalies. After this time, anomalies are automatically baselined and the anomaly detector model will treat new occurrences of similar event as normal. Type: Long Valid Range: Minimum value of 7. Maximum value of 90. Required: No ** creationTimeStamp ** The date and time when this anomaly detector was created. Type: Long Valid Range: Minimum value of 0. Required: No ** detectorName ** The name of the anomaly detector. Type: String Length Constraints: Minimum length of 1. Required: No ** evaluationFrequency ** Specifies how often the anomaly detector runs and look for anomalies. Type: String Valid Values: `ONE_MIN | FIVE_MIN | TEN_MIN | FIFTEEN_MIN | THIRTY_MIN | ONE_HOUR` Required: No ** filterPattern ** A symbolic description of how CloudWatch Logs should interpret the data in each log event. For example, a log event can contain timestamps, IP addresses, strings, and so on. You use the filter pattern to specify what to look for in the log event message. Type: String Length Constraints: Minimum length of 0. Maximum length of 1024. Required: No ** kmsKeyId ** The ARN of the AWS KMS key assigned to this anomaly detector, if any. Type: String Length Constraints: Maximum length of 256. Required: No ** lastModifiedTimeStamp ** The date and time when this anomaly detector was most recently modified. Type: Long Valid Range: Minimum value of 0. Required: No ** logGroupArnList ** A list of the ARNs of the log groups that this anomaly detector watches. Type: Array of strings Length Constraints: Minimum length of 1. Maximum length of 2048. Pattern: `[\w#+=/:,.@-]*` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/AnomalyDetector) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/AnomalyDetector) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/AnomalyDetector) # ConfigurationTemplate A structure containing information about the deafult settings and available settings that you can use to configure a [delivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_Delivery.html) or a [delivery destination](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeliveryDestination.html). ## Contents ** allowedActionForAllowVendedLogsDeliveryForResource ** The action permissions that a caller needs to have to be able to successfully create a delivery source on the desired resource type when calling [PutDeliverySource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliverySource.html). Type: String Required: No ** allowedFieldDelimiters ** The valid values that a caller can use as field delimiters when calling [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html) or [UpdateDeliveryConfiguration](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UpdateDeliveryConfiguration.html) on a delivery that delivers in `Plain`, `W3C`, or `Raw` format. Type: Array of strings Length Constraints: Minimum length of 0. Maximum length of 5. Required: No ** allowedFields ** The allowed fields that a caller can use in the `recordFields` parameter of a [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html) or [UpdateDeliveryConfiguration](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UpdateDeliveryConfiguration.html) operation. Type: Array of [RecordField](API_RecordField.md) objects Required: No ** allowedOutputFormats ** The list of delivery destination output formats that are supported by this log source. Type: Array of strings Valid Values: `json | plain | w3c | raw | parquet` Required: No ** allowedSuffixPathFields ** The list of variable fields that can be used in the suffix path of a delivery that delivers to an S3 bucket. Type: Array of strings Array Members: Minimum number of 0 items. Maximum number of 128 items. Length Constraints: Minimum length of 1. Maximum length of 64. Required: No ** defaultDeliveryConfigValues ** A mapping that displays the default value of each property within a delivery's configuration, if it is not specified in the request. Type: [ConfigurationTemplateDeliveryConfigValues](API_ConfigurationTemplateDeliveryConfigValues.md) object Required: No ** deliveryDestinationType ** A string specifying which destination type this configuration template applies to. Type: String Valid Values: `S3 | CWL | FH | XRAY` Required: No ** logType ** A string specifying which log type this configuration template applies to. Type: String Length Constraints: Minimum length of 1. Maximum length of 255. Pattern: `[\w]*` Required: No ** resourceType ** A string specifying which resource type this configuration template applies to. Type: String Length Constraints: Minimum length of 1. Maximum length of 255. Pattern: `[\w-_]*` Required: No ** service ** A string specifying which service this configuration template applies to. For more information about supported services see [Enable logging from AWS services.](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html). Type: String Length Constraints: Minimum length of 1. Maximum length of 255. Pattern: `[\w_-]*` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ConfigurationTemplate) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ConfigurationTemplate) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ConfigurationTemplate) # ConfigurationTemplateDeliveryConfigValues This structure contains the default values that are used for each configuration parameter when you use [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html) to create a deliver under the current service type, resource type, and log type. ## Contents ** fieldDelimiter ** The default field delimiter that is used in a [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html) operation when the field delimiter is not specified in that operation. The field delimiter is used only when the final output delivery is in `Plain`, `W3C`, or `Raw` format. Type: String Length Constraints: Minimum length of 0. Maximum length of 5. Required: No ** recordFields ** The default record fields that will be delivered when a list of record fields is not provided in a [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html) operation. Type: Array of strings Array Members: Minimum number of 0 items. Maximum number of 128 items. Length Constraints: Minimum length of 1. Maximum length of 64. Required: No ** s3DeliveryConfiguration ** The delivery parameters that are used when you create a delivery to a delivery destination that is an S3 Bucket. Type: [S3DeliveryConfiguration](API_S3DeliveryConfiguration.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ConfigurationTemplateDeliveryConfigValues) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ConfigurationTemplateDeliveryConfigValues) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ConfigurationTemplateDeliveryConfigValues) # CopyValue This processor copies values within a log event. You can also use this processor to add metadata to log events by copying the values of the following metadata keys into the log events: `@logGroupName`, `@logGroupStream`, `@accountId`, `@regionName`. For more information about this processor including examples, see [ copyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-copyValue) in the *CloudWatch Logs User Guide*. ## Contents ** entries ** An array of `CopyValueEntry` objects, where each object contains the information about one field value to copy. Type: Array of [CopyValueEntry](API_CopyValueEntry.md) objects Array Members: Minimum number of 1 item. Maximum number of 5 items. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/CopyValue) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/CopyValue) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/CopyValue) # CopyValueEntry This object defines one value to be copied with the [ copyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-copoyValue) processor. ## Contents ** source ** The key to copy. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** target ** The key of the field to copy the value to. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** overwriteIfExists ** Specifies whether to overwrite the value if the destination key already exists. If you omit this, the default is `false`. Type: Boolean Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/CopyValueEntry) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/CopyValueEntry) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/CopyValueEntry) # CSV The `CSV` processor parses comma-separated values (CSV) from the log events into columns. For more information about this processor including examples, see [ csv](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-csv) in the *CloudWatch Logs User Guide*. ## Contents ** columns ** An array of names to use for the columns in the transformed log event. If you omit this, default column names (`[column_1, column_2 ...]`) are used. Type: Array of strings Array Members: Maximum number of 100 items. Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ** delimiter ** The character used to separate each column in the original comma-separated value log event. If you omit this, the processor looks for the comma `,` character as the delimiter. Type: String Length Constraints: Minimum length of 1. Maximum length of 2. Required: No ** destination ** The path to the parent field to put transformed key value pairs under. If you omit this value, the key value pairs will be placed under the root node. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ** quoteCharacter ** The character used used as a text qualifier for a single column of data. If you omit this, the double quotation mark `"` character is used. Type: String Length Constraints: Fixed length of 1. Required: No ** source ** The path to the field in the log event that has the comma separated values to be parsed. If you omit this value, the whole log message is processed. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/CSV) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/CSV) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/CSV) # DataSource Represents a data source that categorizes logs by originating service and log type, providing service-based organization complementing traditional log groups. ## Contents ** name ** The name of the data source. Type: String Required: Yes ** type ** The type of the data source. Type: String Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/DataSource) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/DataSource) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/DataSource) # DataSourceFilter Filter criteria for data sources, used to specify which data sources to include in operations based on name and type. ## Contents ** name ** The name pattern to filter data sources by. Type: String Required: Yes ** type ** The type pattern to filter data sources by. Type: String Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/DataSourceFilter) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/DataSourceFilter) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/DataSourceFilter) # DateTimeConverter This processor converts a datetime string into a format that you specify. For more information about this processor including examples, see [ datetimeConverter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-datetimeConverter) in the *CloudWatch Logs User Guide*. ## Contents ** matchPatterns ** A list of patterns to match against the `source` field. Type: Array of strings Array Members: Minimum number of 1 item. Maximum number of 5 items. Length Constraints: Minimum length of 1. Required: Yes ** source ** The key to apply the date conversion to. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** target ** The JSON field to store the result in. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** locale ** The locale of the source field. If you omit this, the default of `locale.ROOT` is used. Type: String Length Constraints: Minimum length of 1. Required: No ** sourceTimezone ** The time zone of the source field. If you omit this, the default used is the UTC zone. Type: String Length Constraints: Minimum length of 1. Required: No ** targetFormat ** The datetime format to use for the converted data in the target field. If you omit this, the default of ` yyyy-MM-dd'T'HH:mm:ss.SSS'Z` is used. Type: String Length Constraints: Minimum length of 1. Maximum length of 64. Required: No ** targetTimezone ** The time zone of the target field. If you omit this, the default used is the UTC zone. Type: String Length Constraints: Minimum length of 1. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/DateTimeConverter) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/DateTimeConverter) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/DateTimeConverter) # DeleteKeys This processor deletes entries from a log event. These entries are key-value pairs. For more information about this processor including examples, see [ deleteKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-deleteKeys) in the *CloudWatch Logs User Guide*. ## Contents ** withKeys ** The list of keys to delete. Type: Array of strings Array Members: Minimum number of 1 item. Maximum number of 5 items. Length Constraints: Minimum length of 1. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/DeleteKeys) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/DeleteKeys) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/DeleteKeys) # Delivery This structure contains information about one *delivery* in your account. A delivery is a connection between a logical *delivery source* and a logical *delivery destination*. For more information, see [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html). To update an existing delivery configuration, use [UpdateDeliveryConfiguration](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UpdateDeliveryConfiguration.html). ## Contents ** arn ** The Amazon Resource Name (ARN) that uniquely identifies this delivery. Type: String Required: No ** deliveryDestinationArn ** The ARN of the delivery destination that is associated with this delivery. Type: String Required: No ** deliveryDestinationType ** Displays whether the delivery destination associated with this delivery is CloudWatch Logs, Amazon S3, Firehose, or X-Ray. Type: String Valid Values: `S3 | CWL | FH | XRAY` Required: No ** deliverySourceName ** The name of the delivery source that is associated with this delivery. Type: String Length Constraints: Minimum length of 1. Maximum length of 60. Pattern: `[\w-]*` Required: No ** fieldDelimiter ** The field delimiter that is used between record fields when the final output format of a delivery is in `Plain`, `W3C`, or `Raw` format. Type: String Length Constraints: Minimum length of 0. Maximum length of 5. Required: No ** id ** The unique ID that identifies this delivery in your account. Type: String Length Constraints: Minimum length of 1. Maximum length of 64. Pattern: `^[0-9A-Za-z]+$` Required: No ** recordFields ** The record fields used in this delivery. Type: Array of strings Array Members: Minimum number of 0 items. Maximum number of 128 items. Length Constraints: Minimum length of 1. Maximum length of 64. Required: No ** s3DeliveryConfiguration ** This structure contains delivery configurations that apply only when the delivery destination resource is an S3 bucket. Type: [S3DeliveryConfiguration](API_S3DeliveryConfiguration.md) object Required: No ** tags ** The tags that have been assigned to this delivery. Type: String to string map Map Entries: Maximum number of 50 items. Key Length Constraints: Minimum length of 1. Maximum length of 128. Key Pattern: `^([\p{L}\p{Z}\p{N}_.:/=+\-@]+)$` Value Length Constraints: Maximum length of 256. Value Pattern: `^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/Delivery) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/Delivery) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/Delivery) # DeliveryDestination This structure contains information about one *delivery destination* in your account. A delivery destination is an AWS resource that represents an AWS service that logs can be sent to. CloudWatch Logs, Amazon S3, Firehose, and X-Ray are supported as delivery destinations. To configure logs delivery between a supported AWS service and a destination, you must do the following: + Create a delivery source, which is a logical object that represents the resource that is actually sending the logs. For more information, see [PutDeliverySource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliverySource.html). + Create a *delivery destination*, which is a logical object that represents the actual delivery destination. + If you are delivering logs cross-account, you must use [PutDeliveryDestinationPolicy](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliveryDestinationPolicy.html) in the destination account to assign an IAM policy to the destination. This policy allows delivery to that destination. + Create a *delivery* by pairing exactly one delivery source and one delivery destination. For more information, see [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html). You can configure a single delivery source to send logs to multiple destinations by creating multiple deliveries. You can also create multiple deliveries to configure multiple delivery sources to send logs to the same delivery destination. ## Contents ** arn ** The Amazon Resource Name (ARN) that uniquely identifies this delivery destination. Type: String Required: No ** deliveryDestinationConfiguration ** A structure that contains the ARN of the AWS resource that will receive the logs. Type: [DeliveryDestinationConfiguration](API_DeliveryDestinationConfiguration.md) object Required: No ** deliveryDestinationType ** Displays whether this delivery destination is CloudWatch Logs, Amazon S3, Firehose, or X-Ray. Type: String Valid Values: `S3 | CWL | FH | XRAY` Required: No ** name ** The name of this delivery destination. Type: String Length Constraints: Minimum length of 1. Maximum length of 60. Pattern: `[\w-]*` Required: No ** outputFormat ** The format of the logs that are sent to this delivery destination. Type: String Valid Values: `json | plain | w3c | raw | parquet` Required: No ** tags ** The tags that have been assigned to this delivery destination. Type: String to string map Map Entries: Maximum number of 50 items. Key Length Constraints: Minimum length of 1. Maximum length of 128. Key Pattern: `^([\p{L}\p{Z}\p{N}_.:/=+\-@]+)$` Value Length Constraints: Maximum length of 256. Value Pattern: `^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/DeliveryDestination) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/DeliveryDestination) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/DeliveryDestination) # DeliveryDestinationConfiguration A structure that contains information about one logs delivery destination. ## Contents ** destinationResourceArn ** The ARN of the AWS destination that this delivery destination represents. That AWS destination can be a log group in CloudWatch Logs, an Amazon S3 bucket, or a delivery stream in Firehose. Type: String Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/DeliveryDestinationConfiguration) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/DeliveryDestinationConfiguration) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/DeliveryDestinationConfiguration) # DeliverySource This structure contains information about one *delivery source* in your account. A delivery source is an AWS resource that sends logs to an AWS destination. The destination can be CloudWatch Logs, Amazon S3, or Firehose. Only some AWS services support being configured as a delivery source. These services are listed as **Supported [V2 Permissions]** in the table at [Enabling logging from AWS services.](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html) To configure logs delivery between a supported AWS service and a destination, you must do the following: + Create a delivery source, which is a logical object that represents the resource that is actually sending the logs. For more information, see [PutDeliverySource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliverySource.html). + Create a *delivery destination*, which is a logical object that represents the actual delivery destination. For more information, see [PutDeliveryDestination](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliveryDestination.html). + If you are delivering logs cross-account, you must use [PutDeliveryDestinationPolicy](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliveryDestinationPolicy.html) in the destination account to assign an IAM policy to the destination. This policy allows delivery to that destination. + Create a *delivery* by pairing exactly one delivery source and one delivery destination. For more information, see [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html). You can configure a single delivery source to send logs to multiple destinations by creating multiple deliveries. You can also create multiple deliveries to configure multiple delivery sources to send logs to the same delivery destination. ## Contents ** arn ** The Amazon Resource Name (ARN) that uniquely identifies this delivery source. Type: String Required: No ** logType ** The type of log that the source is sending. For valid values for this parameter, see the documentation for the source service. Type: String Length Constraints: Minimum length of 1. Maximum length of 255. Pattern: `[\w]*` Required: No ** name ** The unique name of the delivery source. Type: String Length Constraints: Minimum length of 1. Maximum length of 60. Pattern: `[\w-]*` Required: No ** resourceArns ** This array contains the ARN of the AWS resource that sends logs and is represented by this delivery source. Currently, only one ARN can be in the array. Type: Array of strings Required: No ** service ** The AWS service that is sending logs. Type: String Length Constraints: Minimum length of 1. Maximum length of 255. Pattern: `[\w_-]*` Required: No ** tags ** The tags that have been assigned to this delivery source. Type: String to string map Map Entries: Maximum number of 50 items. Key Length Constraints: Minimum length of 1. Maximum length of 128. Key Pattern: `^([\p{L}\p{Z}\p{N}_.:/=+\-@]+)$` Value Length Constraints: Maximum length of 256. Value Pattern: `^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/DeliverySource) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/DeliverySource) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/DeliverySource) # Destination Represents a cross-account destination that receives subscription log events. ## Contents ** accessPolicy ** An IAM policy document that governs which AWS accounts can create subscription filters against this destination. Type: String Length Constraints: Minimum length of 1. Required: No ** arn ** The ARN of this destination. Type: String Required: No ** creationTime ** The creation time of the destination, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Type: Long Valid Range: Minimum value of 0. Required: No ** destinationName ** The name of the destination. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[^:*]*` Required: No ** roleArn ** A role for impersonation, used when delivering log events to the target. Type: String Length Constraints: Minimum length of 1. Required: No ** targetArn ** The Amazon Resource Name (ARN) of the physical target where the log events are delivered (for example, a Kinesis stream). Type: String Length Constraints: Minimum length of 1. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/Destination) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/Destination) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/Destination) # DestinationConfiguration Configuration for where to deliver scheduled query results. Specifies the destination type and associated settings for result delivery. ## Contents ** s3Configuration ** Configuration for delivering query results to Amazon S3. Type: [S3Configuration](API_S3Configuration.md) object Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/DestinationConfiguration) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/DestinationConfiguration) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/DestinationConfiguration) # Entity The entity associated with the log events in a `PutLogEvents` call. ## Contents ** attributes ** Additional attributes of the entity that are not used to specify the identity of the entity. A list of key-value pairs. For details about how to use the attributes, see [How to add related information to telemetry](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/adding-your-own-related-telemetry.html) in the *CloudWatch User Guide*. Type: String to string map Map Entries: Minimum number of 0 items. Maximum number of 10 items. Key Length Constraints: Minimum length of 1. Maximum length of 256. Value Length Constraints: Minimum length of 1. Maximum length of 512. Required: No ** keyAttributes ** The attributes of the entity which identify the specific entity, as a list of key-value pairs. Entities with the same `keyAttributes` are considered to be the same entity. There are five allowed attributes (key names): `Type`, `ResourceType`, `Identifier` `Name`, and `Environment`. For details about how to use the key attributes, see [How to add related information to telemetry](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/adding-your-own-related-telemetry.html) in the *CloudWatch User Guide*. Type: String to string map Map Entries: Minimum number of 2 items. Maximum number of 4 items. Key Length Constraints: Minimum length of 1. Maximum length of 32. Value Length Constraints: Minimum length of 1. Maximum length of 512. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/Entity) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/Entity) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/Entity) # ExportTask Represents an export task. ## Contents ** destination ** The name of the S3 bucket to which the log data was exported. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Required: No ** destinationPrefix ** The prefix that was used as the start of Amazon S3 key for every object exported. Type: String Required: No ** executionInfo ** Execution information about the export task. Type: [ExportTaskExecutionInfo](API_ExportTaskExecutionInfo.md) object Required: No ** from ** The start time, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Events with a timestamp before this time are not exported. Type: Long Valid Range: Minimum value of 0. Required: No ** logGroupName ** The name of the log group from which logs data was exported. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** status ** The status of the export task. Type: [ExportTaskStatus](API_ExportTaskStatus.md) object Required: No ** taskId ** The ID of the export task. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Required: No ** taskName ** The name of the export task. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Required: No ** to ** The end time, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Events with a timestamp later than this time are not exported. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ExportTask) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ExportTask) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ExportTask) # ExportTaskExecutionInfo Represents the status of an export task. ## Contents ** completionTime ** The completion time of the export task, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ** creationTime ** The creation time of the export task, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ExportTaskExecutionInfo) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ExportTaskExecutionInfo) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ExportTaskExecutionInfo) # ExportTaskStatus Represents the status of an export task. ## Contents ** code ** The status code of the export task. Type: String Valid Values: `CANCELLED | COMPLETED | FAILED | PENDING | PENDING_CANCEL | RUNNING` Required: No ** message ** The status message related to the status code. Type: String Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ExportTaskStatus) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ExportTaskStatus) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ExportTaskStatus) # FieldIndex This structure describes one log event field that is used as an index in at least one index policy in this account. ## Contents ** fieldIndexName ** The string that this field index matches. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** firstEventTime ** The time and date of the earliest log event that matches this field index, after the index policy that contains it was created. Type: Long Valid Range: Minimum value of 0. Required: No ** lastEventTime ** The time and date of the most recent log event that matches this field index. Type: Long Valid Range: Minimum value of 0. Required: No ** lastScanTime ** The most recent time that CloudWatch Logs scanned ingested log events to search for this field index to improve the speed of future CloudWatch Logs Insights queries that search for this field index. Type: Long Valid Range: Minimum value of 0. Required: No ** logGroupIdentifier ** If this field index appears in an index policy that applies only to a single log group, the ARN of that log group is displayed here. Type: String Length Constraints: Minimum length of 1. Maximum length of 2048. Pattern: `[\w#+=/:,.@-]*` Required: No ** type ** The type of index. Specify `FACET` for facet-based indexing or `FIELD_INDEX` for field-based indexing. This determines how the field is indexed and can be queried. Type: String Valid Values: `FACET | FIELD_INDEX` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/FieldIndex) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/FieldIndex) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/FieldIndex) # FieldsData A structure containing the extracted fields from a log event. These fields are extracted based on the log format and can be used for structured querying and analysis. ## Contents ** data ** The actual log data content returned in the streaming response. This contains the fields and values of the log event in a structured format that can be parsed and processed by the client. Type: Base64-encoded binary data object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/FieldsData) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/FieldsData) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/FieldsData) # FilteredLogEvent Represents a matched event. ## Contents ** eventId ** The ID of the event. Type: String Required: No ** ingestionTime ** The time the event was ingested, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ** logStreamName ** The name of the log stream to which this event belongs. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[^:*]*` Required: No ** message ** The data contained in the log event. Type: String Length Constraints: Minimum length of 1. Required: No ** timestamp ** The time the event occurred, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/FilteredLogEvent) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/FilteredLogEvent) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/FilteredLogEvent) # GetLogObjectResponseStream A stream of structured log data returned by the GetLogObject operation. This stream contains log events with their associated metadata and extracted fields. ## Contents ** fields ** A structure containing the extracted fields from a log event. These fields are extracted based on the log format and can be used for structured querying and analysis. Type: [FieldsData](API_FieldsData.md) object Required: No ** InternalStreamingException ** An internal error occurred during the streaming of log data. This exception is thrown when there's an issue with the internal streaming mechanism used by the GetLogObject operation. Type: Exception HTTP Status Code: Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/GetLogObjectResponseStream) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/GetLogObjectResponseStream) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/GetLogObjectResponseStream) # Grok This processor uses pattern matching to parse and structure unstructured data. This processor can also extract fields from log messages. For more information about this processor including examples, see [grok](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Configurable.html#CloudWatch-Logs-Transformation-Grok) in the *CloudWatch Logs User Guide*. ## Contents ** match ** The grok pattern to match against the log event. For a list of supported grok patterns, see [Supported grok patterns](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Configurable.html#CloudWatch-Logs-Transformation-Grok). Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Required: Yes ** source ** The path to the field in the log event that you want to parse. If you omit this value, the whole log message is parsed. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/Grok) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/Grok) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/Grok) # GroupingIdentifier A key-value pair that identifies how log groups are grouped in aggregate summaries. ## Contents ** key ** The key that identifies the grouping characteristic. The format of the key uses dot notation. Examples are, `dataSource.Name`, `dataSource.Type`, and `dataSource.Format`. Type: String Required: No ** value ** The value associated with the grouping characteristic. Examples are `amazon_vpc`, `flow`, and `OCSF`. Type: String Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/GroupingIdentifier) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/GroupingIdentifier) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/GroupingIdentifier) # Import An import job to move data from CloudTrail Event Data Store to CloudWatch. ## Contents ** creationTime ** The timestamp when the import task was created, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Type: Long Valid Range: Minimum value of 0. Required: No ** errorMessage ** Error message related to any failed imports Type: String Required: No ** importDestinationArn ** The ARN of the managed CloudWatch Logs log group where the events are being imported to. Type: String Required: No ** importFilter ** The filter criteria used for this import task. Type: [ImportFilter](API_ImportFilter.md) object Required: No ** importId ** The unique identifier of the import task. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Pattern: `[\-a-zA-Z0-9]+` Required: No ** importSourceArn ** The ARN of the CloudTrail Lake Event Data Store being imported from. Type: String Required: No ** importStatistics ** Statistics about the import progress Type: [ImportStatistics](API_ImportStatistics.md) object Required: No ** importStatus ** The current status of the import task. Valid values are IN\$1PROGRESS, CANCELLED, COMPLETED and FAILED. Type: String Valid Values: `IN_PROGRESS | CANCELLED | COMPLETED | FAILED` Required: No ** lastUpdatedTime ** The timestamp when the import task was last updated, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/Import) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/Import) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/Import) # ImportBatch A collection of events being imported to CloudWatch ## Contents ** batchId ** The unique identifier of the import batch. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Required: Yes ** status ** The current status of the import batch. Valid values are IN\$1PROGRESS, CANCELLED, COMPLETED and FAILED. Type: String Valid Values: `IN_PROGRESS | CANCELLED | COMPLETED | FAILED` Required: Yes ** errorMessage ** The error message if the batch failed to import. Only present when status is FAILED. Type: String Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ImportBatch) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ImportBatch) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ImportBatch) # ImportFilter The filter criteria used for import tasks ## Contents ** endEventTime ** The end of the time range for events to import, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Type: Long Valid Range: Minimum value of 0. Required: No ** startEventTime ** The start of the time range for events to import, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ImportFilter) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ImportFilter) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ImportFilter) # ImportStatistics Statistics about the import progress ## Contents ** bytesImported ** The total number of bytes that have been imported to the managed log group. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ImportStatistics) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ImportStatistics) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ImportStatistics) # IndexPolicy This structure contains information about one field index policy in this account. ## Contents ** lastUpdateTime ** The date and time that this index policy was most recently updated. Type: Long Valid Range: Minimum value of 0. Required: No ** logGroupIdentifier ** The ARN of the log group that this index policy applies to. Type: String Length Constraints: Minimum length of 1. Maximum length of 2048. Pattern: `[\w#+=/:,.@-]*` Required: No ** policyDocument ** The policy document for this index policy, in JSON format. Type: String Length Constraints: Minimum length of 1. Maximum length of 51200. Required: No ** policyName ** The name of this policy. Responses about log group-level field index policies don't have this field, because those policies don't have names. Type: String Required: No ** source ** This field indicates whether this is an account-level index policy or an index policy that applies only to a single log group. Type: String Valid Values: `ACCOUNT | LOG_GROUP` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/IndexPolicy) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/IndexPolicy) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/IndexPolicy) # InputLogEvent Represents a log event, which is a record of activity that was recorded by the application or resource being monitored. ## Contents ** message ** The raw event message. Each log event can be no larger than 1 MB. Type: String Length Constraints: Minimum length of 1. Required: Yes ** timestamp ** The time the event occurred, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/InputLogEvent) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/InputLogEvent) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/InputLogEvent) # IntegrationDetails This structure contains information about the integration configuration. For an integration with OpenSearch Service, this includes information about OpenSearch Service resources such as the collection, the workspace, and policies. This structure is returned by a [GetIntegration](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetIntegration.html) operation. ## Contents **Important** This data type is a UNION, so only one of the following members can be specified when used or returned. ** openSearchIntegrationDetails ** This structure contains complete information about one integration between CloudWatch Logs and OpenSearch Service. Type: [OpenSearchIntegrationDetails](API_OpenSearchIntegrationDetails.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/IntegrationDetails) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/IntegrationDetails) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/IntegrationDetails) # IntegrationSummary This structure contains information about one CloudWatch Logs integration. This structure is returned by a [ListIntegrations](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_ListIntegrations.html) operation. ## Contents ** integrationName ** The name of this integration. Type: String Length Constraints: Minimum length of 1. Maximum length of 50. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** integrationStatus ** The current status of this integration. Type: String Valid Values: `PROVISIONING | ACTIVE | FAILED` Required: No ** integrationType ** The type of integration. Integrations with OpenSearch Service have the type `OPENSEARCH`. Type: String Valid Values: `OPENSEARCH` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/IntegrationSummary) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/IntegrationSummary) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/IntegrationSummary) # ListToMap This processor takes a list of objects that contain key fields, and converts them into a map of target keys. For more information about this processor including examples, see [ listToMap](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html#CloudWatch-Logs-Transformation-listToMap) in the *CloudWatch Logs User Guide*. ## Contents ** key ** The key of the field to be extracted as keys in the generated map Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** source ** The key in the log event that has a list of objects that will be converted to a map. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** flatten ** A Boolean value to indicate whether the list will be flattened into single items. Specify `true` to flatten the list. The default is `false` Type: Boolean Required: No ** flattenedElement ** If you set `flatten` to `true`, use `flattenedElement` to specify which element, `first` or `last`, to keep. You must specify this parameter if `flatten` is `true` Type: String Valid Values: `first | last` Required: No ** target ** The key of the field that will hold the generated map Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ** valueKey ** If this is specified, the values that you specify in this parameter will be extracted from the `source` objects and put into the values of the generated map. Otherwise, original objects in the source list will be put into the values of the generated map. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ListToMap) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ListToMap) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ListToMap) # LiveTailSessionLogEvent This object contains the information for one log event returned in a Live Tail stream. ## Contents ** ingestionTime ** The timestamp specifying when this log event was ingested into the log group. Type: Long Valid Range: Minimum value of 0. Required: No ** logGroupIdentifier ** The name or ARN of the log group that ingested this log event. Type: String Length Constraints: Minimum length of 1. Maximum length of 2048. Pattern: `[\w#+=/:,.@-]*` Required: No ** logStreamName ** The name of the log stream that ingested this log event. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[^:*]*` Required: No ** message ** The log event message text. Type: String Length Constraints: Minimum length of 1. Required: No ** timestamp ** The timestamp specifying when this log event was created. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LiveTailSessionLogEvent) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LiveTailSessionLogEvent) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LiveTailSessionLogEvent) # LiveTailSessionMetadata This object contains the metadata for one `LiveTailSessionUpdate` structure. It indicates whether that update includes only a sample of 500 log events out of a larger number of ingested log events, or if it contains all of the matching log events ingested during that second of time. ## Contents ** sampled ** If this is `true`, then more than 500 log events matched the request for this update, and the `sessionResults` includes a sample of 500 of those events. If this is `false`, then 500 or fewer log events matched the request for this update, so no sampling was necessary. In this case, the `sessionResults` array includes all log events that matched your request during this time. Type: Boolean Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LiveTailSessionMetadata) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LiveTailSessionMetadata) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LiveTailSessionMetadata) # LiveTailSessionStart This object contains information about this Live Tail session, including the log groups included and the log stream filters, if any. ## Contents ** logEventFilterPattern ** An optional pattern to filter the results to include only log events that match the pattern. For example, a filter pattern of `error 404` displays only log events that include both `error` and `404`. For more information about filter pattern syntax, see [Filter and Pattern Syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html). Type: String Length Constraints: Minimum length of 0. Maximum length of 1024. Required: No ** logGroupIdentifiers ** An array of the names and ARNs of the log groups included in this Live Tail session. Type: Array of strings Array Members: Minimum number of 1 item. Maximum number of 10 items. Length Constraints: Minimum length of 1. Maximum length of 2048. Pattern: `[\w#+=/:,.@-]*` Required: No ** logStreamNamePrefixes ** If your StartLiveTail operation request included a `logStreamNamePrefixes` parameter that filtered the session to only include log streams that have names that start with certain prefixes, these prefixes are listed here. Type: Array of strings Array Members: Minimum number of 1 item. Maximum number of 100 items. Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[^:*]*` Required: No ** logStreamNames ** If your StartLiveTail operation request included a `logStreamNames` parameter that filtered the session to only include certain log streams, these streams are listed here. Type: Array of strings Array Members: Minimum number of 1 item. Maximum number of 100 items. Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[^:*]*` Required: No ** requestId ** The unique ID generated by CloudWatch Logs to identify this Live Tail session request. Type: String Length Constraints: Minimum length of 0. Maximum length of 256. Required: No ** sessionId ** The unique ID generated by CloudWatch Logs to identify this Live Tail session. Type: String Length Constraints: Minimum length of 0. Maximum length of 256. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LiveTailSessionStart) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LiveTailSessionStart) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LiveTailSessionStart) # LiveTailSessionUpdate This object contains the log events and metadata for a Live Tail session. ## Contents ** sessionMetadata ** This object contains the session metadata for a Live Tail session. Type: [LiveTailSessionMetadata](API_LiveTailSessionMetadata.md) object Required: No ** sessionResults ** An array, where each member of the array includes the information for one log event in the Live Tail session. A `sessionResults` array can include as many as 500 log events. If the number of log events matching the request exceeds 500 per second, the log events are sampled down to 500 log events to be included in each `sessionUpdate` structure. Type: Array of [LiveTailSessionLogEvent](API_LiveTailSessionLogEvent.md) objects Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LiveTailSessionUpdate) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LiveTailSessionUpdate) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LiveTailSessionUpdate) # LogEvent This structure contains the information for one sample log event that is associated with an anomaly found by a log anomaly detector. ## Contents ** message ** The message content of the log event. Type: String Length Constraints: Minimum length of 1. Required: No ** timestamp ** The time stamp of the log event. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LogEvent) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LogEvent) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LogEvent) # LogFieldsListItem Represents a log field with its name and data type information for a specific data source. ## Contents ** logFieldName ** The name of the log field. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Required: No ** logFieldType ** The data type information for the log field. Type: [LogFieldType](API_LogFieldType.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LogFieldsListItem) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LogFieldsListItem) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LogFieldsListItem) # LogFieldType Defines the data type structure for a log field, including the type, element information, and nested fields for complex types. ## Contents ** element ** For array or collection types, specifies the element type information. Type: [LogFieldType](#API_LogFieldType) object Required: No ** fields ** For complex types, contains the nested field definitions. Type: Array of [LogFieldsListItem](API_LogFieldsListItem.md) objects Required: No ** type ** The data type of the log field. Type: String Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LogFieldType) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LogFieldType) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LogFieldType) # LogGroup Represents a log group. ## Contents ** arn ** The Amazon Resource Name (ARN) of the log group. This version of the ARN includes a trailing `:*` after the log group name. Use this version to refer to the ARN in IAM policies when specifying permissions for most API actions. The exception is when specifying permissions for [TagResource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_TagResource.html), [UntagResource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UntagResource.html), and [ListTagsForResource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_ListTagsForResource.html). The permissions for those three actions require the ARN version that doesn't include a trailing `:*`. Type: String Required: No ** bearerTokenAuthenticationEnabled ** Indicates whether bearer token authentication is enabled for this log group. When enabled, bearer token authentication is allowed on operations until it is explicitly disabled. Type: Boolean Required: No ** creationTime ** The creation time of the log group, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC. Type: Long Valid Range: Minimum value of 0. Required: No ** dataProtectionStatus ** Displays whether this log group has a protection policy, or whether it had one in the past. For more information, see [PutDataProtectionPolicy](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDataProtectionPolicy.html). Type: String Valid Values: `ACTIVATED | DELETED | ARCHIVED | DISABLED` Required: No ** deletionProtectionEnabled ** Indicates whether deletion protection is enabled for this log group. When enabled, deletion protection blocks all deletion operations until it is explicitly disabled. Type: Boolean Required: No ** inheritedProperties ** Displays all the properties that this log group has inherited from account-level settings. Type: Array of strings Valid Values: `ACCOUNT_DATA_PROTECTION` Required: No ** kmsKeyId ** The Amazon Resource Name (ARN) of the AWS KMS key to use when encrypting log data. Type: String Length Constraints: Maximum length of 256. Required: No ** logGroupArn ** The Amazon Resource Name (ARN) of the log group. This version of the ARN doesn't include a trailing `:*` after the log group name. Use this version to refer to the ARN in the following situations: + In the `logGroupIdentifier` input field in many CloudWatch Logs APIs. + In the `resourceArn` field in tagging APIs + In IAM policies, when specifying permissions for [TagResource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_TagResource.html), [UntagResource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UntagResource.html), and [ListTagsForResource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_ListTagsForResource.html). Type: String Required: No ** logGroupClass ** This specifies the log group class for this log group. There are three classes: + The `Standard` log class supports all CloudWatch Logs features. + The `Infrequent Access` log class supports a subset of CloudWatch Logs features and incurs lower costs. + Use the `Delivery` log class only for delivering AWS Lambda logs to store in Amazon S3 or Amazon Data Firehose. Log events in log groups in the Delivery class are kept in CloudWatch Logs for only one day. This log class doesn't offer rich CloudWatch Logs capabilities such as CloudWatch Logs Insights queries. For details about the features supported by the Standard and Infrequent Access classes, see [Log classes](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch_Logs_Log_Classes.html) Type: String Valid Values: `STANDARD | INFREQUENT_ACCESS | DELIVERY` Required: No ** logGroupName ** The name of the log group. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** metricFilterCount ** The number of metric filters. Type: Integer Required: No ** retentionInDays ** The number of days to retain the log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, and 3653. To set a log group so that its log events do not expire, use [DeleteRetentionPolicy](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteRetentionPolicy.html). Type: Integer Required: No ** storedBytes ** The number of bytes stored. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LogGroup) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LogGroup) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LogGroup) # LogGroupField The fields contained in log events found by a `GetLogGroupFields` operation, along with the percentage of queried log events in which each field appears. ## Contents ** name ** The name of a log field. Type: String Required: No ** percent ** The percentage of log events queried that contained the field. Type: Integer Valid Range: Minimum value of 0. Maximum value of 100. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LogGroupField) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LogGroupField) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LogGroupField) # LogGroupSummary This structure contains information about one log group in your account. ## Contents ** logGroupArn ** The Amazon Resource Name (ARN) of the log group. Type: String Required: No ** logGroupClass ** The log group class for this log group. For details about the features supported by each log group class, see [Log classes](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch_Logs_Log_Classes.html) Type: String Valid Values: `STANDARD | INFREQUENT_ACCESS | DELIVERY` Required: No ** logGroupName ** The name of the log group. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LogGroupSummary) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LogGroupSummary) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LogGroupSummary) # LogStream Represents a log stream, which is a sequence of log events from a single emitter of logs. ## Contents ** arn ** The Amazon Resource Name (ARN) of the log stream. Type: String Required: No ** creationTime ** The creation time of the stream, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ** firstEventTimestamp ** The time of the first event, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ** lastEventTimestamp ** The time of the most recent log event in the log stream in CloudWatch Logs. This number is expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. The `lastEventTime` value updates on an eventual consistency basis. It typically updates in less than an hour from ingestion, but in rare situations might take longer. Type: Long Valid Range: Minimum value of 0. Required: No ** lastIngestionTime ** The ingestion time, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC` The `lastIngestionTime` value updates on an eventual consistency basis. It typically updates in less than an hour after ingestion, but in rare situations might take longer. Type: Long Valid Range: Minimum value of 0. Required: No ** logStreamName ** The name of the log stream. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[^:*]*` Required: No ** storedBytes ** *This member has been deprecated.* The number of bytes stored. **Important:** As of June 17, 2019, this parameter is no longer supported for log streams, and is always reported as zero. This change applies only to log streams. The `storedBytes` parameter for log groups is not affected. Type: Long Valid Range: Minimum value of 0. Required: No ** uploadSequenceToken ** The sequence token. The sequence token is now ignored in `PutLogEvents` actions. `PutLogEvents` actions are always accepted regardless of receiving an invalid sequence token. You don't need to obtain `uploadSequenceToken` to use a `PutLogEvents` action. Type: String Length Constraints: Minimum length of 1. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LogStream) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LogStream) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LogStream) # LookupTable Contains metadata about a lookup table returned by `DescribeLookupTables`. ## Contents ** description ** The description of the lookup table. Type: String Length Constraints: Minimum length of 0. Maximum length of 1024. Required: No ** kmsKeyId ** The ARN of the AWS KMS key used to encrypt the lookup table data, if applicable. Type: String Length Constraints: Maximum length of 256. Required: No ** lastUpdatedTime ** The time when the lookup table was last updated, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ** lookupTableArn ** The ARN of the lookup table. Type: String Required: No ** lookupTableName ** The name of the lookup table. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Pattern: `^[a-zA-Z0-9_]+$` Required: No ** recordsCount ** The number of data rows in the lookup table, excluding the header row. Type: Long Valid Range: Minimum value of 0. Required: No ** sizeBytes ** The size of the lookup table in bytes. Type: Long Valid Range: Minimum value of 0. Required: No ** tableFields ** The column headers from the first row of the CSV file. Type: Array of strings Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LookupTable) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LookupTable) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LookupTable) # LowerCaseString This processor converts a string to lowercase. For more information about this processor including examples, see [ lowerCaseString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-lowerCaseString) in the *CloudWatch Logs User Guide*. ## Contents ** withKeys ** The array caontaining the keys of the fields to convert to lowercase. Type: Array of strings Array Members: Minimum number of 1 item. Maximum number of 10 items. Length Constraints: Minimum length of 1. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/LowerCaseString) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/LowerCaseString) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/LowerCaseString) # MetricFilter Metric filters express how CloudWatch Logs would extract metric observations from ingested log events and transform them into metric data in a CloudWatch metric. ## Contents ** applyOnTransformedLogs ** This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see [PutTransformer](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutTransformer.html). If this value is `true`, the metric filter is applied on the transformed version of the log events instead of the original ingested log events. Type: Boolean Required: No ** creationTime ** The creation time of the metric filter, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ** emitSystemFieldDimensions ** The list of system fields that are emitted as additional dimensions in the generated metrics. Returns the `emitSystemFieldDimensions` value if it was specified when the metric filter was created. Type: Array of strings Required: No ** fieldSelectionCriteria ** The filter expression that specifies which log events are processed by this metric filter based on system fields. Returns the `fieldSelectionCriteria` value if it was specified when the metric filter was created. Type: String Length Constraints: Minimum length of 0. Maximum length of 2000. Required: No ** filterName ** The name of the metric filter. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[^:*]*` Required: No ** filterPattern ** A symbolic description of how CloudWatch Logs should interpret the data in each log event. For example, a log event can contain timestamps, IP addresses, strings, and so on. You use the filter pattern to specify what to look for in the log event message. Type: String Length Constraints: Minimum length of 0. Maximum length of 1024. Required: No ** logGroupName ** The name of the log group. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** metricTransformations ** The metric transformations. Type: Array of [MetricTransformation](API_MetricTransformation.md) objects Array Members: Fixed number of 1 item. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/MetricFilter) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/MetricFilter) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/MetricFilter) # MetricFilterMatchRecord Represents a matched event. ## Contents ** eventMessage ** The raw event data. Type: String Length Constraints: Minimum length of 1. Required: No ** eventNumber ** The event number. Type: Long Required: No ** extractedValues ** The values extracted from the event data by the filter. Type: String to string map Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/MetricFilterMatchRecord) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/MetricFilterMatchRecord) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/MetricFilterMatchRecord) # MetricTransformation Indicates how to transform ingested log events to metric data in a CloudWatch metric. ## Contents ** metricName ** The name of the CloudWatch metric. Type: String Length Constraints: Maximum length of 255. Pattern: `[^:*$]*` Required: Yes ** metricNamespace ** A custom namespace to contain your metric in CloudWatch. Use namespaces to group together metrics that are similar. For more information, see [Namespaces](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html#Namespace). Type: String Length Constraints: Maximum length of 255. Pattern: `[^:*$]*` Required: Yes ** metricValue ** The value to publish to the CloudWatch metric when a filter pattern matches a log event. Type: String Length Constraints: Maximum length of 100. Required: Yes ** defaultValue ** (Optional) The value to emit when a filter pattern does not match a log event. This value can be null. Type: Double Required: No ** dimensions ** The fields to use as dimensions for the metric. One metric filter can include as many as three dimensions. Metrics extracted from log events are charged as custom metrics. To prevent unexpected high charges, do not specify high-cardinality fields such as `IPAddress` or `requestID` as dimensions. Each different value found for a dimension is treated as a separate metric and accrues charges as a separate custom metric. CloudWatch Logs disables a metric filter if it generates 1000 different name/value pairs for your specified dimensions within a certain amount of time. This helps to prevent accidental high charges. You can also set up a billing alarm to alert you if your charges are higher than expected. For more information, see [ Creating a Billing Alarm to Monitor Your Estimated AWS Charges](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.html). Type: String to string map Key Length Constraints: Maximum length of 255. Value Length Constraints: Maximum length of 255. Required: No ** unit ** The unit to assign to the metric. If you omit this, the unit is set as `None`. Type: String Valid Values: `Seconds | Microseconds | Milliseconds | Bytes | Kilobytes | Megabytes | Gigabytes | Terabytes | Bits | Kilobits | Megabits | Gigabits | Terabits | Percent | Count | Bytes/Second | Kilobytes/Second | Megabytes/Second | Gigabytes/Second | Terabytes/Second | Bits/Second | Kilobits/Second | Megabits/Second | Gigabits/Second | Terabits/Second | Count/Second | None` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/MetricTransformation) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/MetricTransformation) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/MetricTransformation) # MoveKeyEntry This object defines one key that will be moved with the [ moveKey](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-moveKey) processor. ## Contents ** source ** The key to move. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** target ** The key to move to. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** overwriteIfExists ** Specifies whether to overwrite the value if the destination key already exists. If you omit this, the default is `false`. Type: Boolean Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/MoveKeyEntry) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/MoveKeyEntry) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/MoveKeyEntry) # MoveKeys This processor moves a key from one field to another. The original key is deleted. For more information about this processor including examples, see [ moveKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-moveKeys) in the *CloudWatch Logs User Guide*. ## Contents ** entries ** An array of objects, where each object contains the information about one key to move. Type: Array of [MoveKeyEntry](API_MoveKeyEntry.md) objects Array Members: Minimum number of 1 item. Maximum number of 5 items. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/MoveKeys) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/MoveKeys) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/MoveKeys) # OpenSearchApplication This structure contains information about the OpenSearch Service application used for this integration. An OpenSearch Service application is the web application created by the integration with CloudWatch Logs. It hosts the vended logs dashboards. ## Contents ** applicationArn ** The Amazon Resource Name (ARN) of the application. Type: String Required: No ** applicationEndpoint ** The endpoint of the application. Type: String Length Constraints: Minimum length of 1. Maximum length of 1024. Pattern: `^https://[\.\-_/#:A-Za-z0-9]+\.com$` Required: No ** applicationId ** The ID of the application. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** status ** This structure contains information about the status of this OpenSearch Service resource. Type: [OpenSearchResourceStatus](API_OpenSearchResourceStatus.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OpenSearchApplication) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OpenSearchApplication) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OpenSearchApplication) # OpenSearchCollection This structure contains information about the OpenSearch Service collection used for this integration. An OpenSearch Service collection is a logical grouping of one or more indexes that represent an analytics workload. For more information, see [Creating and managing OpenSearch Service Serverless collections](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-collections.html). ## Contents ** collectionArn ** The ARN of the collection. Type: String Required: No ** collectionEndpoint ** The endpoint of the collection. Type: String Length Constraints: Minimum length of 1. Maximum length of 1024. Pattern: `^https://[\.\-_/#:A-Za-z0-9]+\.com$` Required: No ** status ** This structure contains information about the status of this OpenSearch Service resource. Type: [OpenSearchResourceStatus](API_OpenSearchResourceStatus.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OpenSearchCollection) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OpenSearchCollection) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OpenSearchCollection) # OpenSearchDataAccessPolicy This structure contains information about the OpenSearch Service data access policy used for this integration. The access policy defines the access controls for the collection. This data access policy was automatically created as part of the integration setup. For more information about OpenSearch Service data access policies, see [Data access control for Amazon OpenSearch Serverless](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html) in the OpenSearch Service Developer Guide. ## Contents ** policyName ** The name of the data access policy. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** status ** This structure contains information about the status of this OpenSearch Service resource. Type: [OpenSearchResourceStatus](API_OpenSearchResourceStatus.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OpenSearchDataAccessPolicy) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OpenSearchDataAccessPolicy) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OpenSearchDataAccessPolicy) # OpenSearchDataSource This structure contains information about the OpenSearch Service data source used for this integration. This data source was created as part of the integration setup. An OpenSearch Service data source defines the source and destination for OpenSearch Service queries. It includes the role required to execute queries and write to collections. For more information about OpenSearch Service data sources , see [Creating OpenSearch Service data source integrations with Amazon S3.](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/direct-query-s3-creating.html) ## Contents ** dataSourceName ** The name of the OpenSearch Service data source. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** status ** This structure contains information about the status of this OpenSearch Service resource. Type: [OpenSearchResourceStatus](API_OpenSearchResourceStatus.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OpenSearchDataSource) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OpenSearchDataSource) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OpenSearchDataSource) # OpenSearchEncryptionPolicy This structure contains information about the OpenSearch Service encryption policy used for this integration. The encryption policy was created automatically when you created the integration. For more information, see [Encryption policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html#serverless-encryption-policies) in the OpenSearch Service Developer Guide. ## Contents ** policyName ** The name of the encryption policy. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** status ** This structure contains information about the status of this OpenSearch Service resource. Type: [OpenSearchResourceStatus](API_OpenSearchResourceStatus.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OpenSearchEncryptionPolicy) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OpenSearchEncryptionPolicy) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OpenSearchEncryptionPolicy) # OpenSearchIntegrationDetails This structure contains complete information about one CloudWatch Logs integration. This structure is returned by a [GetIntegration](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetIntegration.html) operation. ## Contents ** accessPolicy ** This structure contains information about the OpenSearch Service data access policy used for this integration. The access policy defines the access controls for the collection. This data access policy was automatically created as part of the integration setup. For more information about OpenSearch Service data access policies, see [Data access control for Amazon OpenSearch Serverless](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-data-access.html) in the OpenSearch Service Developer Guide. Type: [OpenSearchDataAccessPolicy](API_OpenSearchDataAccessPolicy.md) object Required: No ** application ** This structure contains information about the OpenSearch Service application used for this integration. An OpenSearch Service application is the web application that was created by the integration with CloudWatch Logs. It hosts the vended logs dashboards. Type: [OpenSearchApplication](API_OpenSearchApplication.md) object Required: No ** collection ** This structure contains information about the OpenSearch Service collection used for this integration. This collection was created as part of the integration setup. An OpenSearch Service collection is a logical grouping of one or more indexes that represent an analytics workload. For more information, see [Creating and managing OpenSearch Service Serverless collections](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-collections.html). Type: [OpenSearchCollection](API_OpenSearchCollection.md) object Required: No ** dataSource ** This structure contains information about the OpenSearch Service data source used for this integration. This data source was created as part of the integration setup. An OpenSearch Service data source defines the source and destination for OpenSearch Service queries. It includes the role required to execute queries and write to collections. For more information about OpenSearch Service data sources , see [Creating OpenSearch Service data source integrations with Amazon S3.](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/direct-query-s3-creating.html) Type: [OpenSearchDataSource](API_OpenSearchDataSource.md) object Required: No ** encryptionPolicy ** This structure contains information about the OpenSearch Service encryption policy used for this integration. The encryption policy was created automatically when you created the integration. For more information, see [Encryption policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-encryption.html#serverless-encryption-policies) in the OpenSearch Service Developer Guide. Type: [OpenSearchEncryptionPolicy](API_OpenSearchEncryptionPolicy.md) object Required: No ** lifecyclePolicy ** This structure contains information about the OpenSearch Service data lifecycle policy used for this integration. The lifecycle policy determines the lifespan of the data in the collection. It was automatically created as part of the integration setup. For more information, see [Using data lifecycle policies with OpenSearch Service Serverless](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-lifecycle.html) in the OpenSearch Service Developer Guide. Type: [OpenSearchLifecyclePolicy](API_OpenSearchLifecyclePolicy.md) object Required: No ** networkPolicy ** This structure contains information about the OpenSearch Service network policy used for this integration. The network policy assigns network access settings to collections. For more information, see [Network policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html#serverless-network-policies) in the OpenSearch Service Developer Guide. Type: [OpenSearchNetworkPolicy](API_OpenSearchNetworkPolicy.md) object Required: No ** workspace ** This structure contains information about the OpenSearch Service workspace used for this integration. An OpenSearch Service workspace is the collection of dashboards along with other OpenSearch Service tools. This workspace was created automatically as part of the integration setup. For more information, see [Centralized OpenSearch user interface (Dashboards) with OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/application.html). Type: [OpenSearchWorkspace](API_OpenSearchWorkspace.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OpenSearchIntegrationDetails) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OpenSearchIntegrationDetails) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OpenSearchIntegrationDetails) # OpenSearchLifecyclePolicy This structure contains information about the OpenSearch Service data lifecycle policy used for this integration. The lifecycle policy determines the lifespan of the data in the collection. It was automatically created as part of the integration setup. For more information, see [Using data lifecycle policies with OpenSearch Service Serverless](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-lifecycle.html) in the OpenSearch Service Developer Guide. ## Contents ** policyName ** The name of the lifecycle policy. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** status ** This structure contains information about the status of this OpenSearch Service resource. Type: [OpenSearchResourceStatus](API_OpenSearchResourceStatus.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OpenSearchLifecyclePolicy) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OpenSearchLifecyclePolicy) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OpenSearchLifecyclePolicy) # OpenSearchNetworkPolicy This structure contains information about the OpenSearch Service network policy used for this integration. The network policy assigns network access settings to collections. For more information, see [Network policies](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/serverless-network.html#serverless-network-policies) in the OpenSearch Service Developer Guide. ## Contents ** policyName ** The name of the network policy. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** status ** This structure contains information about the status of this OpenSearch Service resource. Type: [OpenSearchResourceStatus](API_OpenSearchResourceStatus.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OpenSearchNetworkPolicy) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OpenSearchNetworkPolicy) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OpenSearchNetworkPolicy) # OpenSearchResourceConfig This structure contains configuration details about an integration between CloudWatch Logs and OpenSearch Service. ## Contents ** dashboardViewerPrincipals ** Specify the ARNs of IAM roles and IAM users who you want to grant permission to for viewing the dashboards. In addition to specifying these users here, you must also grant them the **CloudWatchOpenSearchDashboardAccess** IAM policy. For more information, see [IAM policies for users](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/OpenSearch-Dashboards-UserRoles.html). Type: Array of strings Required: Yes ** dataSourceRoleArn ** Specify the ARN of an IAM role that CloudWatch Logs will use to create the integration. This role must have the permissions necessary to access the OpenSearch Service collection to be able to create the dashboards. For more information about the permissions needed, see [Permissions that the integration needs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/OpenSearch-Dashboards-CreateRole.html) in the CloudWatch Logs User Guide. Type: String Required: Yes ** retentionDays ** Specify how many days that you want the data derived by OpenSearch Service to be retained in the index that the dashboard refers to. This also sets the maximum time period that you can choose when viewing data in the dashboard. Choosing a longer time frame will incur additional costs. Type: Integer Valid Range: Minimum value of 1. Maximum value of 30. Required: Yes ** applicationArn ** If you want to use an existing OpenSearch Service application for your integration with OpenSearch Service, specify it here. If you omit this, a new application will be created. Type: String Required: No ** kmsKeyArn ** To have the vended dashboard data encrypted with AWS KMS instead of the CloudWatch Logs default encryption method, specify the ARN of the AWS KMS key that you want to use. Type: String Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OpenSearchResourceConfig) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OpenSearchResourceConfig) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OpenSearchResourceConfig) # OpenSearchResourceStatus This structure contains information about the status of an OpenSearch Service resource. ## Contents ** status ** The current status of this resource. Type: String Valid Values: `ACTIVE | NOT_FOUND | ERROR` Required: No ** statusMessage ** A message with additional information about the status of this resource. Type: String Length Constraints: Minimum length of 1. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OpenSearchResourceStatus) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OpenSearchResourceStatus) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OpenSearchResourceStatus) # OpenSearchWorkspace This structure contains information about the OpenSearch Service workspace used for this integration. An OpenSearch Service workspace is the collection of dashboards along with other OpenSearch Service tools. This workspace was created automatically as part of the integration setup. For more information, see [Centralized OpenSearch user interface (Dashboards) with OpenSearch Service](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/application.html). ## Contents ** status ** This structure contains information about the status of an OpenSearch Service resource. Type: [OpenSearchResourceStatus](API_OpenSearchResourceStatus.md) object Required: No ** workspaceId ** The ID of this workspace. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OpenSearchWorkspace) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OpenSearchWorkspace) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OpenSearchWorkspace) # OutputLogEvent Represents a log event. ## Contents ** ingestionTime ** The time the event was ingested, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ** message ** The data contained in the log event. Type: String Length Constraints: Minimum length of 1. Required: No ** timestamp ** The time the event occurred, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/OutputLogEvent) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/OutputLogEvent) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/OutputLogEvent) # ParseCloudfront This processor parses CloudFront vended logs, extract fields, and convert them into JSON format. Encoded field values are decoded. Values that are integers and doubles are treated as such. For more information about this processor including examples, see [ parseCloudfront](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseCloudfront) For more information about CloudFront log format, see [ Configure and use standard logs (access logs)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html). If you use this processor, it must be the first processor in your transformer. ## Contents ** source ** Omit this parameter and the whole log message will be processed by this processor. No other value than `@message` is allowed for `source`. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ParseCloudfront) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ParseCloudfront) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ParseCloudfront) # ParseJSON This processor parses log events that are in JSON format. It can extract JSON key-value pairs and place them under a destination that you specify. Additionally, because you must have at least one parse-type processor in a transformer, you can use `ParseJSON` as that processor for JSON-format logs, so that you can also apply other processors, such as mutate processors, to these logs. For more information about this processor including examples, see [ parseJSON](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseJSON) in the *CloudWatch Logs User Guide*. ## Contents ** destination ** The location to put the parsed key value pair into. If you omit this parameter, it is placed under the root node. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ** source ** Path to the field in the log event that will be parsed. Use dot notation to access child fields. For example, `store.book` Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ParseJSON) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ParseJSON) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ParseJSON) # ParseKeyValue This processor parses a specified field in the original log event into key-value pairs. For more information about this processor including examples, see [ parseKeyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseKeyValue) in the *CloudWatch Logs User Guide*. ## Contents ** destination ** The destination field to put the extracted key-value pairs into Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ** fieldDelimiter ** The field delimiter string that is used between key-value pairs in the original log events. If you omit this, the ampersand `&` character is used. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ** keyPrefix ** If you want to add a prefix to all transformed keys, specify it here. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ** keyValueDelimiter ** The delimiter string to use between the key and value in each pair in the transformed log event. If you omit this, the equal `=` character is used. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ** nonMatchValue ** A value to insert into the value field in the result, when a key-value pair is not successfully split. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ** overwriteIfExists ** Specifies whether to overwrite the value if the destination key already exists. If you omit this, the default is `false`. Type: Boolean Required: No ** source ** Path to the field in the log event that will be parsed. Use dot notation to access child fields. For example, `store.book` Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ParseKeyValue) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ParseKeyValue) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ParseKeyValue) # ParsePostgres Use this processor to parse RDS for PostgreSQL vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message. For more information about this processor including examples, see [ parsePostGres](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parsePostGres). For more information about RDS for PostgreSQL log format, see [ RDS for PostgreSQL database log filesTCP flag sequence](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_LogAccess.Concepts.PostgreSQL.html#USER_LogAccess.Concepts.PostgreSQL.Log_Format.log-line-prefix). **Important** If you use this processor, it must be the first processor in your transformer. ## Contents ** source ** Omit this parameter and the whole log message will be processed by this processor. No other value than `@message` is allowed for `source`. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ParsePostgres) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ParsePostgres) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ParsePostgres) # ParseRoute53 Use this processor to parse Route 53 vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message. For more information about this processor including examples, see [ parseRoute53](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseRoute53). **Important** If you use this processor, it must be the first processor in your transformer. ## Contents ** source ** Omit this parameter and the whole log message will be processed by this processor. No other value than `@message` is allowed for `source`. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ParseRoute53) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ParseRoute53) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ParseRoute53) # ParseToOCSF This processor converts logs into [Open Cybersecurity Schema Framework (OCSF)](https://ocsf.io) events. For more information about this processor including examples, see [parseToOCSF](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseToOCSF) in the *CloudWatch Logs User Guide*. ## Contents ** eventSource ** Specify the service or process that produces the log events that will be converted with this processor. Type: String Valid Values: `CloudTrail | Route53Resolver | VPCFlow | EKSAudit | AWSWAF` Required: Yes ** ocsfVersion ** Specify which version of the OCSF schema to use for the transformed log events. Type: String Valid Values: `V1.1 | V1.5` Required: Yes ** mappingVersion ** The version of the OCSF mapping to use for parsing log data. Type: String Length Constraints: Minimum length of 1. Maximum length of 10. Pattern: `^\d+\.\d+(\.\d+)?$` Required: No ** source ** The path to the field in the log event that you want to parse. If you omit this value, the whole log message is parsed. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ParseToOCSF) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ParseToOCSF) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ParseToOCSF) # ParseVPC Use this processor to parse Amazon VPC vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message. This processor doesn't support custom log formats, such as NAT gateway logs. For more information about custom log formats in Amazon VPC, see [ parseVPC](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html#flow-log-example-tcp-flag) For more information about this processor including examples, see [ parseVPC](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseVPC). **Important** If you use this processor, it must be the first processor in your transformer. ## Contents ** source ** Omit this parameter and the whole log message will be processed by this processor. No other value than `@message` is allowed for `source`. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ParseVPC) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ParseVPC) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ParseVPC) # ParseWAF Use this processor to parse AWS WAF vended logs, extract fields, and and convert them into a JSON format. This processor always processes the entire log event message. For more information about this processor including examples, see [ parseWAF](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parsePostGres). For more information about AWS WAF log format, see [ Log examples for web ACL traffic](https://docs.aws.amazon.com/waf/latest/developerguide/logging-examples.html). **Important** If you use this processor, it must be the first processor in your transformer. ## Contents ** source ** Omit this parameter and the whole log message will be processed by this processor. No other value than `@message` is allowed for `source`. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ParseWAF) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ParseWAF) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ParseWAF) # PatternToken A structure that contains information about one pattern token related to an anomaly. For more information about patterns and tokens, see [CreateLogAnomalyDetector](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogAnomalyDetector.html). ## Contents ** dynamicTokenPosition ** For a dynamic token, this indicates where in the pattern that this token appears, related to other dynamic tokens. The dynamic token that appears first has a value of `1`, the one that appears second is `2`, and so on. Type: Integer Required: No ** enumerations ** Contains the values found for a dynamic token, and the number of times each value was found. Type: String to long map Key Length Constraints: Minimum length of 1. Required: No ** inferredTokenName ** A name that CloudWatch Logs assigned to this dynamic token to make the pattern more readable. The string part of the `inferredTokenName` gives you a clearer idea of the content of this token. The number part of the `inferredTokenName` shows where in the pattern this token appears, compared to other dynamic tokens. CloudWatch Logs assigns the string part of the name based on analyzing the content of the log events that contain it. For example, an inferred token name of `IPAddress-3` means that the token represents an IP address, and this token is the third dynamic token in the pattern. Type: String Length Constraints: Minimum length of 1. Required: No ** isDynamic ** Specifies whether this is a dynamic token. Type: Boolean Required: No ** tokenString ** The string represented by this token. If this is a dynamic token, the value will be `<*>` Type: String Length Constraints: Minimum length of 1. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/PatternToken) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/PatternToken) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/PatternToken) # Policy A structure that contains information about one delivery destination policy. ## Contents ** deliveryDestinationPolicy ** The contents of the delivery destination policy. Type: String Length Constraints: Minimum length of 1. Maximum length of 51200. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/Policy) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/Policy) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/Policy) # Processor This structure contains the information about one processor in a log transformer. ## Contents ** addKeys ** Use this parameter to include the [ addKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-addKeys) processor in your transformer. Type: [AddKeys](API_AddKeys.md) object Required: No ** copyValue ** Use this parameter to include the [ copyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-copyValue) processor in your transformer. Type: [CopyValue](API_CopyValue.md) object Required: No ** csv ** Use this parameter to include the [ CSV](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-CSV) processor in your transformer. Type: [CSV](API_CSV.md) object Required: No ** dateTimeConverter ** Use this parameter to include the [ datetimeConverter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-datetimeConverter) processor in your transformer. Type: [DateTimeConverter](API_DateTimeConverter.md) object Required: No ** deleteKeys ** Use this parameter to include the [ deleteKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-deleteKeys) processor in your transformer. Type: [DeleteKeys](API_DeleteKeys.md) object Required: No ** grok ** Use this parameter to include the [ grok](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-grok) processor in your transformer. Type: [Grok](API_Grok.md) object Required: No ** listToMap ** Use this parameter to include the [ listToMap](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-listToMap) processor in your transformer. Type: [ListToMap](API_ListToMap.md) object Required: No ** lowerCaseString ** Use this parameter to include the [ lowerCaseString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-lowerCaseString) processor in your transformer. Type: [LowerCaseString](API_LowerCaseString.md) object Required: No ** moveKeys ** Use this parameter to include the [ moveKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-moveKeys) processor in your transformer. Type: [MoveKeys](API_MoveKeys.md) object Required: No ** parseCloudfront ** Use this parameter to include the [ parseCloudfront](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseCloudfront) processor in your transformer. If you use this processor, it must be the first processor in your transformer. Type: [ParseCloudfront](API_ParseCloudfront.md) object Required: No ** parseJSON ** Use this parameter to include the [ parseJSON](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseJSON) processor in your transformer. Type: [ParseJSON](API_ParseJSON.md) object Required: No ** parseKeyValue ** Use this parameter to include the [ parseKeyValue](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseKeyValue) processor in your transformer. Type: [ParseKeyValue](API_ParseKeyValue.md) object Required: No ** parsePostgres ** Use this parameter to include the [ parsePostGres](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parsePostGres) processor in your transformer. If you use this processor, it must be the first processor in your transformer. Type: [ParsePostgres](API_ParsePostgres.md) object Required: No ** parseRoute53 ** Use this parameter to include the [ parseRoute53](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseRoute53) processor in your transformer. If you use this processor, it must be the first processor in your transformer. Type: [ParseRoute53](API_ParseRoute53.md) object Required: No ** parseToOCSF ** Use this parameter to convert logs into Open Cybersecurity Schema (OCSF) format. Type: [ParseToOCSF](API_ParseToOCSF.md) object Required: No ** parseVPC ** Use this parameter to include the [ parseVPC](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseVPC) processor in your transformer. If you use this processor, it must be the first processor in your transformer. Type: [ParseVPC](API_ParseVPC.md) object Required: No ** parseWAF ** Use this parameter to include the [ parseWAF](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-parseWAF) processor in your transformer. If you use this processor, it must be the first processor in your transformer. Type: [ParseWAF](API_ParseWAF.md) object Required: No ** renameKeys ** Use this parameter to include the [ renameKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-renameKeys) processor in your transformer. Type: [RenameKeys](API_RenameKeys.md) object Required: No ** splitString ** Use this parameter to include the [ splitString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-splitString) processor in your transformer. Type: [SplitString](API_SplitString.md) object Required: No ** substituteString ** Use this parameter to include the [ substituteString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-substituteString) processor in your transformer. Type: [SubstituteString](API_SubstituteString.md) object Required: No ** trimString ** Use this parameter to include the [ trimString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-trimString) processor in your transformer. Type: [TrimString](API_TrimString.md) object Required: No ** typeConverter ** Use this parameter to include the [ typeConverter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-typeConverter) processor in your transformer. Type: [TypeConverter](API_TypeConverter.md) object Required: No ** upperCaseString ** Use this parameter to include the [ upperCaseString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-upperCaseString) processor in your transformer. Type: [UpperCaseString](API_UpperCaseString.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/Processor) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/Processor) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/Processor) # QueryCompileError Reserved. ## Contents ** location ** Reserved. Type: [QueryCompileErrorLocation](API_QueryCompileErrorLocation.md) object Required: No ** message ** Reserved. Type: String Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/QueryCompileError) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/QueryCompileError) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/QueryCompileError) # QueryCompileErrorLocation Reserved. ## Contents ** endCharOffset ** Reserved. Type: Integer Required: No ** startCharOffset ** Reserved. Type: Integer Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/QueryCompileErrorLocation) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/QueryCompileErrorLocation) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/QueryCompileErrorLocation) # QueryDefinition This structure contains details about a saved CloudWatch Logs Insights query definition. ## Contents ** lastModified ** The date that the query definition was most recently modified. Type: Long Valid Range: Minimum value of 0. Required: No ** logGroupNames ** If this query definition contains a list of log groups that it is limited to, that list appears here. Type: Array of strings Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** name ** The name of the query definition. Type: String Length Constraints: Minimum length of 1. Maximum length of 255. Required: No ** parameters ** If this query definition contains a list of query parameters that define placeholder variables for the query string, that list appears here. Type: Array of [QueryParameter](API_QueryParameter.md) objects Array Members: Maximum number of 20 items. Required: No ** queryDefinitionId ** The unique ID of the query definition. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Required: No ** queryLanguage ** The query language used for this query. For more information about the query languages that CloudWatch Logs supports, see [Supported query languages](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_Languages.html). Type: String Valid Values: `CWLI | SQL | PPL` Required: No ** queryString ** The query string to use for this definition. For more information, see [CloudWatch Logs Insights Query Syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html). Type: String Length Constraints: Minimum length of 1. Maximum length of 10000. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/QueryDefinition) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/QueryDefinition) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/QueryDefinition) # QueryInfo Information about one CloudWatch Logs Insights query that matches the request in a `DescribeQueries` operation. ## Contents ** bytesScanned ** The total number of bytes scanned by the query. This indicates the cost associated with the query. Type: Double Required: No ** createTime ** The date and time that this query was created. Type: Long Valid Range: Minimum value of 0. Required: No ** logGroupName ** The name of the log group scanned by this query. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** queryDuration ** The duration in milliseconds that the query took to execute. Type: Long Required: No ** queryId ** The unique ID number of this query. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Required: No ** queryLanguage ** The query language used for this query. For more information about the query languages that CloudWatch Logs supports, see [Supported query languages](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_Languages.html). Type: String Valid Values: `CWLI | SQL | PPL` Required: No ** queryString ** The query string used in this query. Type: String Length Constraints: Minimum length of 0. Maximum length of 10000. Required: No ** status ** The status of this query. Possible values are `Cancelled`, `Complete`, `Failed`, `Running`, `Scheduled`, and `Unknown`. Type: String Valid Values: `Scheduled | Running | Complete | Failed | Cancelled | Timeout | Unknown` Required: No ** userIdentity ** The ARN of the user who ran the query. Type: String Length Constraints: Minimum length of 1. Maximum length of 2048. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/QueryInfo) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/QueryInfo) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/QueryInfo) # QueryParameter This structure defines a query parameter for a saved CloudWatch Logs Insights query definition. Query parameters are supported only for Logs Insights QL queries. They are placeholder variables that you can reference in a query string using the `{{parameterName}}` syntax. Each parameter can include a default value and a description. ## Contents ** name ** The name of the query parameter. A query parameter name must start with a letter or underscore, and contain only letters, digits, and underscores. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Pattern: `^[a-zA-Z_][a-zA-Z0-9_]*` Required: Yes ** defaultValue ** The default value to use for this query parameter if no value is supplied at execution time. Type: String Length Constraints: Maximum length of 1024. Required: No ** description ** A description of the query parameter that explains its purpose or expected values. Type: String Length Constraints: Maximum length of 512. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/QueryParameter) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/QueryParameter) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/QueryParameter) # QueryStatistics Contains the number of log events scanned by the query, the number of log events that matched the query criteria, and the total number of bytes in the log events that were scanned. If the query involved log groups that have field index policies, the estimated number of skipped log events and the total bytes of those skipped log events are included. Using field indexes to skip log events in queries reduces scan volume and improves performance. For more information, see [Create field indexes to improve query performance and reduce scan volume](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing.html). ## Contents ** bytesScanned ** The total number of bytes in the log events scanned during the query. Type: Double Required: No ** estimatedBytesSkipped ** An estimate of the number of bytes in the log events that were skipped when processing this query, because the query contained an indexed field. Skipping these entries lowers query costs and improves the query performance time. For more information about field indexes, see [PutIndexPolicy](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutIndexPolicy.html). Type: Double Required: No ** estimatedRecordsSkipped ** An estimate of the number of log events that were skipped when processing this query, because the query contained an indexed field. Skipping these entries lowers query costs and improves the query performance time. For more information about field indexes, see [PutIndexPolicy](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutIndexPolicy.html). Type: Double Required: No ** logGroupsScanned ** The number of log groups that were scanned by this query. Type: Double Required: No ** recordsMatched ** The number of log events that matched the query string. Type: Double Required: No ** recordsScanned ** The total number of log events scanned during the query. Type: Double Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/QueryStatistics) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/QueryStatistics) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/QueryStatistics) # RecordField A structure that represents a valid record field header and whether it is mandatory. ## Contents ** mandatory ** If this is `true`, the record field must be present in the `recordFields` parameter provided to a [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html) or [UpdateDeliveryConfiguration](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UpdateDeliveryConfiguration.html) operation. Type: Boolean Required: No ** name ** The name to use when specifying this record field in a [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html) or [UpdateDeliveryConfiguration](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_UpdateDeliveryConfiguration.html) operation. Type: String Length Constraints: Minimum length of 1. Maximum length of 64. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/RecordField) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/RecordField) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/RecordField) # RejectedEntityInfo If an entity is rejected when a `PutLogEvents` request was made, this includes details about the reason for the rejection. ## Contents ** errorType ** The type of error that caused the rejection of the entity when calling `PutLogEvents`. Type: String Valid Values: `InvalidEntity | InvalidTypeValue | InvalidKeyAttributes | InvalidAttributes | EntitySizeTooLarge | UnsupportedLogGroupType | MissingRequiredFields` Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/RejectedEntityInfo) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/RejectedEntityInfo) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/RejectedEntityInfo) # RejectedLogEventsInfo Represents the rejected events. ## Contents ** expiredLogEventEndIndex ** The expired log events. Type: Integer Required: No ** tooNewLogEventStartIndex ** The index of the first log event that is too new. This field is inclusive. Type: Integer Required: No ** tooOldLogEventEndIndex ** The index of the last log event that is too old. This field is exclusive. Type: Integer Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/RejectedLogEventsInfo) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/RejectedLogEventsInfo) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/RejectedLogEventsInfo) # RenameKeyEntry This object defines one key that will be renamed with the [ renameKey](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-renameKey) processor. ## Contents ** key ** The key to rename Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** renameTo ** The string to use for the new key name Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** overwriteIfExists ** Specifies whether to overwrite the existing value if the destination key already exists. The default is `false` Type: Boolean Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/RenameKeyEntry) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/RenameKeyEntry) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/RenameKeyEntry) # RenameKeys Use this processor to rename keys in a log event. For more information about this processor including examples, see [ renameKeys](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-renameKeys) in the *CloudWatch Logs User Guide*. ## Contents ** entries ** An array of `RenameKeyEntry` objects, where each object contains the information about a single key to rename. Type: Array of [RenameKeyEntry](API_RenameKeyEntry.md) objects Array Members: Minimum number of 1 item. Maximum number of 5 items. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/RenameKeys) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/RenameKeys) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/RenameKeys) # ResourceConfig This structure contains configuration details about an integration between CloudWatch Logs and another entity. ## Contents **Important** This data type is a UNION, so only one of the following members can be specified when used or returned. ** openSearchResourceConfig ** This structure contains configuration details about an integration between CloudWatch Logs and OpenSearch Service. Type: [OpenSearchResourceConfig](API_OpenSearchResourceConfig.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ResourceConfig) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ResourceConfig) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ResourceConfig) # ResourcePolicy A policy enabling one or more entities to put logs to a log group in this account. ## Contents ** lastUpdatedTime ** Timestamp showing when this policy was last updated, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ** policyDocument ** The details of the policy. Type: String Length Constraints: Minimum length of 1. Maximum length of 51200. Required: No ** policyName ** The name of the resource policy. Type: String Required: No ** policyScope ** Specifies scope of the resource policy. Valid values are ACCOUNT or RESOURCE. Type: String Valid Values: `ACCOUNT | RESOURCE` Required: No ** resourceArn ** The ARN of the CloudWatch Logs resource to which the resource policy is attached. Only populated for resource-scoped policies. Type: String Required: No ** revisionId ** The revision ID of the resource policy. Only populated for resource-scoped policies. Type: String Length Constraints: Minimum length of 1. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ResourcePolicy) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ResourcePolicy) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ResourcePolicy) # ResultField Contains one field from one log event returned by a CloudWatch Logs Insights query, along with the value of that field. For more information about the fields that are generated by CloudWatch logs, see [Supported Logs and Discovered Fields](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData-discoverable-fields.html). ## Contents ** field ** The log event field. Type: String Required: No ** value ** The value of this field. Type: String Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ResultField) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ResultField) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ResultField) # S3Configuration Configuration for Amazon S3 destination where scheduled query results are delivered. ## Contents ** destinationIdentifier ** The Amazon S3 URI where query results are delivered. Must be a valid S3 URI format. Type: String Length Constraints: Maximum length of 1024. Pattern: `s3://[a-z0-9][\.\-a-z0-9]{1,61}[a-z0-9](/.*)?` Required: Yes ** roleArn ** The ARN of the IAM role that grants permissions to write query results to the specified Amazon S3 destination. Type: String Length Constraints: Minimum length of 1. Required: Yes ** kmsKeyId ** The Amazon Resource Name (ARN) of the KMS encryption key. Must belong to the same AWS Region as the destination Amazon S3 bucket. Type: String Length Constraints: Maximum length of 256. Required: No ** ownerAccountId ** The AWS accountId for the bucket owning account. Type: String Length Constraints: Fixed length of 12. Pattern: `^\d{12}$` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/S3Configuration) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/S3Configuration) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/S3Configuration) # S3DeliveryConfiguration This structure contains delivery configurations that apply only when the delivery destination resource is an S3 bucket. ## Contents ** enableHiveCompatiblePath ** This parameter causes the S3 objects that contain delivered logs to use a prefix structure that allows for integration with Apache Hive. Type: Boolean Required: No ** suffixPath ** This string allows re-configuring the S3 object prefix to contain either static or variable sections. The valid variables to use in the suffix path will vary by each log source. To find the values supported for the suffix path for each log source, use the [DescribeConfigurationTemplates](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeConfigurationTemplates.html) operation and check the `allowedSuffixPathFields` field in the response. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/S3DeliveryConfiguration) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/S3DeliveryConfiguration) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/S3DeliveryConfiguration) # S3TableIntegrationSource Represents a data source association with an S3 Table Integration, including its status and metadata. ## Contents ** createdTimeStamp ** The timestamp when the data source association was created. Type: Long Valid Range: Minimum value of 0. Required: No ** dataSource ** The data source associated with the S3 Table Integration. Type: [DataSource](API_DataSource.md) object Required: No ** identifier ** The unique identifier for this data source association. Type: String Length Constraints: Minimum length of 1. Maximum length of 2048. Required: No ** status ** The current status of the data source association. Type: String Valid Values: `ACTIVE | UNHEALTHY | FAILED | DATA_SOURCE_DELETE_IN_PROGRESS` Required: No ** statusReason ** Additional information about the status of the data source association. Type: String Length Constraints: Minimum length of 1. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/S3TableIntegrationSource) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/S3TableIntegrationSource) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/S3TableIntegrationSource) # ScheduledQueryDestination Information about a destination where scheduled query results are processed, including processing status and any error messages. ## Contents ** destinationIdentifier ** The identifier for the destination where results are delivered. Type: String Required: No ** destinationType ** The type of destination for query results. Type: String Valid Values: `S3` Required: No ** errorMessage ** Error message if destination processing failed. Type: String Required: No ** processedIdentifier ** The identifier of the processed result at the destination. Type: String Required: No ** status ** The processing status of the destination delivery. Type: String Valid Values: `IN_PROGRESS | CLIENT_ERROR | FAILED | COMPLETE` Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ScheduledQueryDestination) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ScheduledQueryDestination) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ScheduledQueryDestination) # ScheduledQuerySummary Summary information about a scheduled query, including basic configuration and execution status. ## Contents ** creationTime ** The timestamp when the scheduled query was created. Type: Long Valid Range: Minimum value of 0. Required: No ** destinationConfiguration ** Configuration for where query results are delivered. Type: [DestinationConfiguration](API_DestinationConfiguration.md) object Required: No ** lastExecutionStatus ** The status of the most recent execution. Type: String Valid Values: `Running | InvalidQuery | Complete | Failed | Timeout` Required: No ** lastTriggeredTime ** The timestamp when the scheduled query was last executed. Type: Long Valid Range: Minimum value of 0. Required: No ** lastUpdatedTime ** The timestamp when the scheduled query was last updated. Type: Long Valid Range: Minimum value of 0. Required: No ** name ** The name of the scheduled query. Type: String Length Constraints: Minimum length of 1. Maximum length of 255. Pattern: `^[a-zA-Z0-9_\-/.#]+$` Required: No ** scheduledQueryArn ** The ARN of the scheduled query. Type: String Required: No ** scheduleExpression ** The cron expression that defines when the scheduled query runs. Type: String Length Constraints: Maximum length of 256. Required: No ** state ** The current state of the scheduled query. Type: String Valid Values: `ENABLED | DISABLED` Required: No ** timezone ** The timezone used for evaluating the schedule expression. Type: String Length Constraints: Minimum length of 1. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/ScheduledQuerySummary) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/ScheduledQuerySummary) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/ScheduledQuerySummary) # SearchedLogStream Represents the search status of a log stream. ## Contents ** logStreamName ** The name of the log stream. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[^:*]*` Required: No ** searchedCompletely ** Indicates whether all the events in this log stream were searched. Type: Boolean Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/SearchedLogStream) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/SearchedLogStream) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/SearchedLogStream) # SplitString Use this processor to split a field into an array of strings using a delimiting character. For more information about this processor including examples, see [ splitString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-splitString) in the *CloudWatch Logs User Guide*. ## Contents ** entries ** An array of `SplitStringEntry` objects, where each object contains the information about one field to split. Type: Array of [SplitStringEntry](API_SplitStringEntry.md) objects Array Members: Minimum number of 1 item. Maximum number of 10 items. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/SplitString) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/SplitString) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/SplitString) # SplitStringEntry This object defines one log field that will be split with the [ splitString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-splitString) processor. ## Contents ** delimiter ** The separator characters to split the string entry on. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** source ** The key of the field to split. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/SplitStringEntry) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/SplitStringEntry) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/SplitStringEntry) # StartLiveTailResponseStream This object includes the stream returned by your [StartLiveTail](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_StartLiveTail.html) request. ## Contents ** sessionStart ** This object contains information about this Live Tail session, including the log groups included and the log stream filters, if any. Type: [LiveTailSessionStart](API_LiveTailSessionStart.md) object Required: No ** SessionStreamingException ** This exception is returned if an unknown error occurs. Type: Exception HTTP Status Code: Required: No ** SessionTimeoutException ** This exception is returned in the stream when the Live Tail session times out. Live Tail sessions time out after three hours. Type: Exception HTTP Status Code: Required: No ** sessionUpdate ** This object contains the log events and session metadata. Type: [LiveTailSessionUpdate](API_LiveTailSessionUpdate.md) object Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/StartLiveTailResponseStream) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/StartLiveTailResponseStream) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/StartLiveTailResponseStream) # SubscriptionFilter Represents a subscription filter. ## Contents ** applyOnTransformedLogs ** This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see [PutTransformer](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutTransformer.html). If this value is `true`, the subscription filter is applied on the transformed version of the log events instead of the original ingested log events. Type: Boolean Required: No ** creationTime ** The creation time of the subscription filter, expressed as the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`. Type: Long Valid Range: Minimum value of 0. Required: No ** destinationArn ** The Amazon Resource Name (ARN) of the destination. Type: String Length Constraints: Minimum length of 1. Required: No ** distribution ** The method used to distribute log data to the destination, which can be either random or grouped by log stream. Type: String Valid Values: `Random | ByLogStream` Required: No ** emitSystemFields ** The list of system fields that are included in the log events sent to the subscription destination. Returns the `emitSystemFields` value if it was specified when the subscription filter was created. Type: Array of strings Required: No ** fieldSelectionCriteria ** The filter expression that specifies which log events are processed by this subscription filter based on system fields. Returns the `fieldSelectionCriteria` value if it was specified when the subscription filter was created. Type: String Length Constraints: Minimum length of 0. Maximum length of 2000. Required: No ** filterName ** The name of the subscription filter. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[^:*]*` Required: No ** filterPattern ** A symbolic description of how CloudWatch Logs should interpret the data in each log event. For example, a log event can contain timestamps, IP addresses, strings, and so on. You use the filter pattern to specify what to look for in the log event message. Type: String Length Constraints: Minimum length of 0. Maximum length of 1024. Required: No ** logGroupName ** The name of the log group. Type: String Length Constraints: Minimum length of 1. Maximum length of 512. Pattern: `[\.\-_/#A-Za-z0-9]+` Required: No ** roleArn ** Type: String Length Constraints: Minimum length of 1. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/SubscriptionFilter) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/SubscriptionFilter) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/SubscriptionFilter) # SubstituteString This processor matches a key’s value against a regular expression and replaces all matches with a replacement string. For more information about this processor including examples, see [ substituteString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-substituteString) in the *CloudWatch Logs User Guide*. ## Contents ** entries ** An array of objects, where each object contains the information about one key to match and replace. Type: Array of [SubstituteStringEntry](API_SubstituteStringEntry.md) objects Array Members: Minimum number of 1 item. Maximum number of 10 items. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/SubstituteString) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/SubstituteString) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/SubstituteString) # SubstituteStringEntry This object defines one log field key that will be replaced using the [ substituteString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-substituteString) processor. ## Contents ** from ** The regular expression string to be replaced. Special regex characters such as [ and ] must be escaped using \$1\$1 when using double quotes and with \$1 when using single quotes. For more information, see [ Class Pattern](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/regex/Pattern.html) on the Oracle web site. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** source ** The key to modify Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** to ** The string to be substituted for each match of `from` Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/SubstituteStringEntry) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/SubstituteStringEntry) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/SubstituteStringEntry) # SuppressionPeriod If you are suppressing an anomaly temporariliy, this structure defines how long the suppression period is to be. ## Contents ** suppressionUnit ** Specifies whether the value of `value` is in seconds, minutes, or hours. Type: String Valid Values: `SECONDS | MINUTES | HOURS` Required: No ** value ** Specifies the number of seconds, minutes or hours to suppress this anomaly. There is no maximum. Type: Integer Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/SuppressionPeriod) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/SuppressionPeriod) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/SuppressionPeriod) # TransformedLogRecord This structure contains information for one log event that has been processed by a log transformer. ## Contents ** eventMessage ** The original log event message before it was transformed. Type: String Length Constraints: Minimum length of 1. Required: No ** eventNumber ** The event number. Type: Long Required: No ** transformedEventMessage ** The log event message after being transformed. Type: String Length Constraints: Minimum length of 1. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/TransformedLogRecord) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/TransformedLogRecord) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/TransformedLogRecord) # TriggerHistoryRecord A record of a scheduled query execution, including execution status, timestamp, and destination processing results. ## Contents ** destinations ** Information about destination processing for this query execution. Type: Array of [ScheduledQueryDestination](API_ScheduledQueryDestination.md) objects Required: No ** errorMessage ** Error message if the query execution failed. Type: String Required: No ** executionStatus ** The execution status of the scheduled query run. Type: String Valid Values: `Running | InvalidQuery | Complete | Failed | Timeout` Required: No ** queryId ** The unique identifier for this query execution. Type: String Length Constraints: Minimum length of 1. Maximum length of 256. Required: No ** triggeredTimestamp ** The timestamp when the scheduled query execution was triggered. Type: Long Valid Range: Minimum value of 0. Required: No ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/TriggerHistoryRecord) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/TriggerHistoryRecord) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/TriggerHistoryRecord) # TrimString Use this processor to remove leading and trailing whitespace. For more information about this processor including examples, see [ trimString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-trimString) in the *CloudWatch Logs User Guide*. ## Contents ** withKeys ** The array containing the keys of the fields to trim. Type: Array of strings Array Members: Minimum number of 1 item. Maximum number of 10 items. Length Constraints: Minimum length of 1. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/TrimString) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/TrimString) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/TrimString) # TypeConverter Use this processor to convert a value type associated with the specified key to the specified type. It's a casting processor that changes the types of the specified fields. Values can be converted into one of the following datatypes: `integer`, `double`, `string` and `boolean`. For more information about this processor including examples, see [ trimString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-trimString) in the *CloudWatch Logs User Guide*. ## Contents ** entries ** An array of `TypeConverterEntry` objects, where each object contains the information about one field to change the type of. Type: Array of [TypeConverterEntry](API_TypeConverterEntry.md) objects Array Members: Minimum number of 1 item. Maximum number of 5 items. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/TypeConverter) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/TypeConverter) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/TypeConverter) # TypeConverterEntry This object defines one value type that will be converted using the [ typeConverter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-typeConverter) processor. ## Contents ** key ** The key with the value that is to be converted to a different type. Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Required: Yes ** type ** The type to convert the field value to. Valid values are `integer`, `double`, `string` and `boolean`. Type: String Valid Values: `boolean | integer | double | string` Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/TypeConverterEntry) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/TypeConverterEntry) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/TypeConverterEntry) # UpperCaseString This processor converts a string field to uppercase. For more information about this processor including examples, see [ upperCaseString](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html#CloudWatch-Logs-Transformation-upperCaseString) in the *CloudWatch Logs User Guide*. ## Contents ** withKeys ** The array of containing the keys of the field to convert to uppercase. Type: Array of strings Array Members: Minimum number of 1 item. Maximum number of 10 items. Length Constraints: Minimum length of 1. Required: Yes ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/UpperCaseString) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/UpperCaseString) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/UpperCaseString)