QueryStringProps

class aws_cdk.aws_logs.QueryStringProps(*, display=None, fields=None, filter=None, filter_statements=None, limit=None, parse=None, parse_statements=None, sort=None, stats=None, stats_statements=None)

Bases: object

Properties for a QueryString.

Parameters:

  • display (Optional[str]) – Specifies which fields to display in the query results. Default: - no display in QueryString

  • fields (Optional[Sequence[str]]) – Retrieves the specified fields from log events for display. Default: - no fields in QueryString

  • filter (Optional[str]) – (deprecated) A single statement for filtering the results of a query based on a boolean expression. Default: - no filter in QueryString

  • filter_statements (Optional[Sequence[str]]) – An array of one or more statements for filtering the results of a query based on a boolean expression. Each provided statement generates a separate filter line in the query string. Note: If provided, this property overrides any value provided for the filter property. Default: - no filter in QueryString

  • limit (Union[int, float, None]) – Specifies the number of log events returned by the query. Default: - no limit in QueryString

  • parse (Optional[str]) – (deprecated) A single statement for parsing data from a log field and creating ephemeral fields that can be processed further in the query. Default: - no parse in QueryString

  • parse_statements (Optional[Sequence[str]]) – An array of one or more statements for parsing data from a log field and creating ephemeral fields that can be processed further in the query. Each provided statement generates a separate parse line in the query string. Note: If provided, this property overrides any value provided for the parse property. Default: - no parse in QueryString

  • sort (Optional[str]) – Sorts the retrieved log events. Default: - no sort in QueryString

  • stats (Optional[str]) – (deprecated) A single statement for using log field values to calculate aggregate statistics. Default: - no stats in QueryString

  • stats_statements (Optional[Sequence[str]]) – An array of one or more statements for calculating aggregate statistics. CloudWatch Logs Insights supports up to two stats commands in a single query. Each provided statement generates a separate stats line in the query string. Note: If provided, this property overrides any value provided for the stats property. Default: - no stats in QueryString

ExampleMetadata:

infused

Example:

logs.QueryDefinition(self, "QueryDefinition",
    query_definition_name="MyQuery",
    query_string=logs.QueryString(
        fields=["@timestamp", "@message"],
        parse_statements=["@message "[*] *" as loggingType, loggingMessage", "@message "<*>: *" as differentLoggingType, differentLoggingMessage"
        ],
        filter_statements=["loggingType = "ERROR"", "loggingMessage = "A very strange error occurred!""
        ],
        stats_statements=["count(loggingMessage) as loggingErrors", "count(differentLoggingMessage) as differentLoggingErrors"
        ],
        sort="@timestamp desc",
        limit=20
    )
)

Attributes

display

Specifies which fields to display in the query results.

Default:

  • no display in QueryString

fields

Retrieves the specified fields from log events for display.

Default:

  • no fields in QueryString

filter

(deprecated) A single statement for filtering the results of a query based on a boolean expression.

Default:

  • no filter in QueryString

Deprecated:

Use filterStatements instead

Stability:

deprecated

filter_statements

An array of one or more statements for filtering the results of a query based on a boolean expression.

Each provided statement generates a separate filter line in the query string.

Note: If provided, this property overrides any value provided for the filter property.

Default:

  • no filter in QueryString

limit

Specifies the number of log events returned by the query.

Default:

  • no limit in QueryString

parse

(deprecated) A single statement for parsing data from a log field and creating ephemeral fields that can be processed further in the query.

Default:

  • no parse in QueryString

Deprecated:

Use parseStatements instead

Stability:

deprecated

parse_statements

An array of one or more statements for parsing data from a log field and creating ephemeral fields that can be processed further in the query.

Each provided statement generates a separate parse line in the query string.

Note: If provided, this property overrides any value provided for the parse property.

Default:

  • no parse in QueryString

sort

Sorts the retrieved log events.

Default:

  • no sort in QueryString

stats

(deprecated) A single statement for using log field values to calculate aggregate statistics.

Default:

  • no stats in QueryString

Deprecated:

Use statsStatements instead

Stability:

deprecated

stats_statements

An array of one or more statements for calculating aggregate statistics.

CloudWatch Logs Insights supports up to two stats commands in a single query. Each provided statement generates a separate stats line in the query string.

Note: If provided, this property overrides any value provided for the stats property.

Default:

  • no stats in QueryString