# CfnSubscriptionFilterProps

Properties for defining a `CfnSubscriptionFilter`.

Extends: CfnSubscriptionFilterProps
Used as props by: CfnSubscriptionFilter

- Source: Generated code
- Type last changed: v2.227.0 · 21 Nov 2025

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_logs as logs } from 'aws-cdk-lib';
const cfnSubscriptionFilterProps: logs.CfnSubscriptionFilterProps = {
  destinationArn: 'destinationArn',
  filterPattern: 'filterPattern',
  logGroupName: 'logGroupName',

  // the properties below are optional
  applyOnTransformedLogs: false,
  distribution: 'distribution',
  emitSystemFields: ['emitSystemFields'],
  fieldSelectionCriteria: 'fieldSelectionCriteria',
  filterName: 'filterName',
  roleArn: 'roleArn',
};
```

## Properties

- `applyOnTransformedLogs`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — This parameter is valid only for log groups that have an active log transformer.

  For more information about log transformers, see [PutTransformer](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutTransformer.html) .

  If this value is `true` , the subscription filter is applied on the transformed version of the log events instead of the original ingested log events.

- `destinationArn`: string | [IStreamRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kinesis.IStreamRef.html) | [IDeliveryStreamRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kinesisfirehose.IDeliveryStreamRef.html) | [IFunctionRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_lambda.IFunctionRef.html) (required) — The Amazon Resource Name (ARN) of the destination.

- `distribution`: string — The method used to distribute log data to the destination, which can be either random or grouped by log stream.

- `emitSystemFields`: string[] — The list of system fields that are included in the log events sent to the subscription destination.

  Returns the `emitSystemFields` value if it was specified when the subscription filter was created.

- `fieldSelectionCriteria`: string — The filter expression that specifies which log events are processed by this subscription filter based on system fields.

  Returns the `fieldSelectionCriteria` value if it was specified when the subscription filter was created.

- `filterName`: string — The name of the subscription filter.

- `filterPattern`: string (required) — The filtering expressions that restrict what gets delivered to the destination AWS resource.

  For more information about the filter pattern syntax, see [Filter and Pattern Syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html) .

- `logGroupName`: string | [ILogGroupRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_logs.ILogGroupRef.html) (required) — The log group to associate with the subscription filter.

  All log events that are uploaded to this log group are filtered and delivered to the specified AWS resource if the filter pattern matches the log events.

- `roleArn`: string | [IRoleRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_iam.IRoleRef.html) — The ARN of an IAM role that grants CloudWatch Logs permissions to deliver ingested log events to the destination stream.

  You don't need to provide the ARN when you are working with a logical destination for cross-account delivery.