aws-cdk-lib.aws_logs.QueryStringProps

QueryStringProps Struct

Properties for a QueryString.

Source

aws-logs/lib/query-definition.ts

Type last changed

v2.208.0 · 29 Jul 2025

Example

new logs.QueryDefinition(this, 'QueryDefinition', {
  queryDefinitionName: 'MyQuery',
  queryString: new logs.QueryString({
    fields: ['@timestamp', '@message'],
    parseStatements: [
      '@message "[*] *" as loggingType, loggingMessage',
      '@message "<*>: *" as differentLoggingType, differentLoggingMessage',
    ],
    filterStatements: [
      'loggingType = "ERROR"',
      'loggingMessage = "A very strange error occurred!"',
    ],
    statsStatements: [
      'count(loggingMessage) as loggingErrors',
      'count(differentLoggingMessage) as differentLoggingErrors',
    ],
    sort: '@timestamp desc',
    limit: 20,
  }),
});

Properties

displaystringdisplaystrdisplayStringDisplaystringDisplay*string= no display in QueryString#

Specifies which fields to display in the query results.

fieldsstring[]fieldstyping.List[str]fieldsList<String>Fieldsstring[]Fields*[]*string= no fields in QueryString#

Retrieves the specified fields from log events for display.

filterstringfilterstrfilterStringFilterstringFilter*string= no filter in QueryStringdeprecated#

Use `filterStatements` instead

filterStatementsstring[]filter_statementstyping.List[str]filterStatementsList<String>FilterStatementsstring[]FilterStatements*[]*string= no filter in QueryString#

An array of one or more statements for filtering the results of a query based on a boolean expression.

Each provided statement generates a separate filter line in the query string.

Note: If provided, this property overrides any value provided for the filter property.

limitnumberlimitint | floatlimitNumberLimitdoubleLimit*float64= no limit in QueryString#

Specifies the number of log events returned by the query.

parsestringparsestrparseStringParsestringParse*string= no parse in QueryStringdeprecated#

Use `parseStatements` instead

parseStatementsstring[]parse_statementstyping.List[str]parseStatementsList<String>ParseStatementsstring[]ParseStatements*[]*string= no parse in QueryString#

An array of one or more statements for parsing data from a log field and creating ephemeral fields that can be processed further in the query.

Each provided statement generates a separate parse line in the query string.

Note: If provided, this property overrides any value provided for the parse property.

sortstringsortstrsortStringSortstringSort*string= no sort in QueryString#

Sorts the retrieved log events.

statsstringstatsstrstatsStringStatsstringStats*string= no stats in QueryStringdeprecated#

Use `statsStatements` instead

statsStatementsstring[]stats_statementstyping.List[str]statsStatementsList<String>StatsStatementsstring[]StatsStatements*[]*string= no stats in QueryString#

An array of one or more statements for calculating aggregate statistics.

notes

CloudWatch Logs Insights supports up to two stats commands in a single query. Each provided statement generates a separate stats line in the query string.

Note: If provided, this property overrides any value provided for the stats property.

Used as props by

• QueryString