[ aws . cloudwatchomni ]

get-context-graph

Description

Queries the context graph with filtering, traversal, and pagination support.

Pagination note: nodes and edges are returned together as a coherent subgraph. Pagination cursors advance over nodes (the primary collection); each page includes all edges connecting nodes within that page. Callers should treat nodes as the paginated collection and edges as supplementary relationship data attached to those nodes.

See also: AWS API Documentation

get-context-graph is a paginated operation. Multiple API calls may be issued in order to retrieve the entire data set of results. You can disable pagination by providing the --no-paginate argument. When using --output text and the --query argument on a paginated response, the --query argument must extract data from the results of the following query expressions: nodes

Synopsis

  get-context-graph
[--node-filters <value>]
[--edge-filters <value>]
--start-time <value>
--end-time <value>
[--depth <value>]
[--max-edges-per-node <value>]
[--include-metadata | --no-include-metadata]
[--starting-token <value>]
[--page-size <value>]
[--max-items <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]
[--cli-error-format <value>]

Options

--node-filters (structure)

Criteria restricting which nodes are returned.

nodeId -> (string)

Match only the node with this identifier.

Constraints:

• min: 1
• max: 256

nodeType -> (string)

Match only nodes of this type.

Possible values:

• SERVICE
• RESOURCE
• REMOTE_SERVICE

name -> (string)

Match only nodes with this name.

Constraints:

• min: 1
• max: 512

tags -> (list)

Match nodes by the tags on the underlying resource.

Constraints:

• min: 1
• max: 5

(structure)

Key-value filter used for tags and attributes filtering. Multiple KeyFilters are AND’ed. Multiple values within a single KeyFilter are OR’ed. Values support pattern syntax: exact, negation (!value), wildcard (value, value*, *value).

key -> (string) [required]

The tag or attribute key to filter on.

Constraints:

• min: 1
• max: 128

values -> (list)

The values to match for this key, OR’ed together. Each supports exact, negation (!value), and wildcard (value, value*, *value) syntax.

Constraints:

• min: 0
• max: 50

(string)

Key filter value string.

Constraints:

• min: 0
• max: 259

telemetryAttributes -> (list)

Match nodes by their OpenTelemetry (OTel) telemetry attributes.

Constraints:

• min: 1
• max: 5

(structure)

Key-value filter used for tags and attributes filtering. Multiple KeyFilters are AND’ed. Multiple values within a single KeyFilter are OR’ed. Values support pattern syntax: exact, negation (!value), wildcard (value, value*, *value).

key -> (string) [required]

The tag or attribute key to filter on.

Constraints:

• min: 1
• max: 128

values -> (list)

The values to match for this key, OR’ed together. Each supports exact, negation (!value), and wildcard (value, value*, *value) syntax.

Constraints:

• min: 0
• max: 50

(string)

Key filter value string.

Constraints:

• min: 0
• max: 259

region -> (list)

Match nodes in any of these regions.

Constraints:

• min: 0
• max: 50

(string)

cloudProvider -> (list)

Match nodes on any of these cloud providers.

Constraints:

• min: 0
• max: 50

(string)

sourceAccountId -> (list)

Match nodes discovered from telemetry produced by any of these accounts.

Constraints:

• min: 0
• max: 50

(string)

namespace -> (list)

Match nodes in any of these logical service groupings.

Constraints:

• min: 0
• max: 50

(string)

category -> (list)

Match nodes of any of these categories.

Constraints:

• min: 0
• max: 4

(string)

Coarse classification of what a node is. Orthogonal to NodeType, which says whether the node is a service, a resource, or a remote service. Absent on most nodes today because few producers emit the source attribute.

Possible values:

• GEN_AI_AGENT
• GEN_AI_MODEL
• DATABASE
• MESSAGING_QUEUE
• COMPUTE
• STORAGE
• NETWORK

stage -> (list)

Match nodes observed in any of these deployment environments.

Constraints:

• min: 0
• max: 50

(string)

sources -> (list)

Match nodes contributed by any of these discovery sources.

Constraints:

• min: 0
• max: 20

(string)

Data source enum for context graph queries.

Possible values:

• VPC_FLOW_LOG
• CLOUDTRAIL
• IAM_POLICY
• CODE_SEMANTICS
• TELEMETRY
• AZURE_VNET_FLOW_LOG
• ELB_ACCESS_LOG
• CLOUDFRONT_ACCESS_LOG
• S3_ACCESS_LOG
• WAF_ACCESS_LOG
• AWS_INTEGRATION
• CONFIG

JSON Syntax:

{
  "nodeId": "string",
  "nodeType": "SERVICE"|"RESOURCE"|"REMOTE_SERVICE",
  "name": "string",
  "tags": [
    {
      "key": "string",
      "values": ["string", ...]
    }
    ...
  ],
  "telemetryAttributes": [
    {
      "key": "string",
      "values": ["string", ...]
    }
    ...
  ],
  "region": ["string", ...],
  "cloudProvider": ["string", ...],
  "sourceAccountId": ["string", ...],
  "namespace": ["string", ...],
  "category": ["GEN_AI_AGENT"|"GEN_AI_MODEL"|"DATABASE"|"MESSAGING_QUEUE"|"COMPUTE"|"STORAGE"|"NETWORK", ...],
  "stage": ["string", ...],
  "sources": ["VPC_FLOW_LOG"|"CLOUDTRAIL"|"IAM_POLICY"|"CODE_SEMANTICS"|"TELEMETRY"|"AZURE_VNET_FLOW_LOG"|"ELB_ACCESS_LOG"|"CLOUDFRONT_ACCESS_LOG"|"S3_ACCESS_LOG"|"WAF_ACCESS_LOG"|"AWS_INTEGRATION"|"CONFIG", ...]
}

--edge-filters (structure)

Criteria restricting which edges are returned.

edgeId -> (string)

Match only the edge with this identifier.

Constraints:

• min: 1
• max: 256

from -> (string)

Match only edges originating from this node identifier.

Constraints:

• min: 1
• max: 256

to -> (string)

Match only edges pointing to this node identifier.

Constraints:

• min: 1
• max: 256

edgeType -> (string)

Match only edges of this relationship kind.

Possible values:

• CALLS
• ACCESSES
• RUNS_ON

operations -> (list)

Match edges carrying any of these operations.

Constraints:

• min: 0
• max: 50

(string)

telemetryAttributes -> (list)

Match edges by their OpenTelemetry (OTel) telemetry attributes. Not yet enforced: currently accepted but ignored (does not filter), matching nodeFilters.telemetryAttributes.

Constraints:

• min: 1
• max: 5

(structure)

Key-value filter used for tags and attributes filtering. Multiple KeyFilters are AND’ed. Multiple values within a single KeyFilter are OR’ed. Values support pattern syntax: exact, negation (!value), wildcard (value, value*, *value).

key -> (string) [required]

The tag or attribute key to filter on.

Constraints:

• min: 1
• max: 128

values -> (list)

The values to match for this key, OR’ed together. Each supports exact, negation (!value), and wildcard (value, value*, *value) syntax.

Constraints:

• min: 0
• max: 50

(string)

Key filter value string.

Constraints:

• min: 0
• max: 259

sources -> (list)

Match edges contributed by any of these discovery sources.

Constraints:

• min: 0
• max: 20

(string)

Data source enum for context graph queries.

Possible values:

• VPC_FLOW_LOG
• CLOUDTRAIL
• IAM_POLICY
• CODE_SEMANTICS
• TELEMETRY
• AZURE_VNET_FLOW_LOG
• ELB_ACCESS_LOG
• CLOUDFRONT_ACCESS_LOG
• S3_ACCESS_LOG
• WAF_ACCESS_LOG
• AWS_INTEGRATION
• CONFIG

JSON Syntax:

{
  "edgeId": "string",
  "from": "string",
  "to": "string",
  "edgeType": "CALLS"|"ACCESSES"|"RUNS_ON",
  "operations": ["string", ...],
  "telemetryAttributes": [
    {
      "key": "string",
      "values": ["string", ...]
    }
    ...
  ],
  "sources": ["VPC_FLOW_LOG"|"CLOUDTRAIL"|"IAM_POLICY"|"CODE_SEMANTICS"|"TELEMETRY"|"AZURE_VNET_FLOW_LOG"|"ELB_ACCESS_LOG"|"CLOUDFRONT_ACCESS_LOG"|"S3_ACCESS_LOG"|"WAF_ACCESS_LOG"|"AWS_INTEGRATION"|"CONFIG", ...]
}

--start-time (timestamp) [required]

Start of the time range (UTC), inclusive.

--end-time (timestamp) [required]

End of the time range (UTC), inclusive.

--depth (integer)

How many hops to traverse out from the nodes matched by nodeFilters. 0 returns only the matched nodes themselves.

Constraints:

• min: 0
• max: 3

--max-edges-per-node (integer)

The maximum number of edges to return per node, bounding the fan-out of a densely connected node.

Constraints:

• min: 1
• max: 50

--include-metadata | --no-include-metadata (boolean)

Whether to return the metadata block, semantics included, on each node and edge. Off by default because it costs an extra lookup per returned node.

--starting-token (string)

A token to specify where to start paginating. This is the NextToken from a previously truncated response.

For usage examples, see Pagination in the AWS Command Line Interface User Guide .

--page-size (integer)

The size of each page to get in the AWS service call. This does not affect the number of items returned in the command’s output. Setting a smaller page size results in more calls to the AWS service, retrieving fewer items in each call. This can help prevent the AWS service calls from timing out.

For usage examples, see Pagination in the AWS Command Line Interface User Guide .

Constraints:

• min: 1
• max: 1000

--max-items (integer)

The total number of items to return in the command’s output. If the total number of items available is more than the value specified, a NextToken is provided in the command’s output. To resume pagination, provide the NextToken value in the starting-token argument of a subsequent command. Do not use the NextToken response element directly outside of the AWS CLI.

For usage examples, see Pagination in the AWS Command Line Interface User Guide .

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

Global Options

--debug (boolean)

Turn on debug logging.

--endpoint-url (string)

Override command’s default URL with the given URL.

--no-verify-ssl (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

--no-paginate (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

--output (string)

The formatting style for command output.

• json
• text
• table
• yaml
• yaml-stream
• off

--query (string)

A JMESPath query to use in filtering the response data.

--profile (string)

Use a specific profile from your credential file.

--region (string)

The region to use. Overrides config/env settings.

--version (string)

Display the version of this tool.

--color (string)

Turn on/off color output.

• on
• off
• auto

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

--ca-bundle (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

--cli-read-timeout (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

--cli-connect-timeout (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

--cli-binary-format (string)

The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb:// will always be treated as binary and use the file contents directly regardless of the cli-binary-format setting. When using file:// the file contents will need to properly formatted for the configured cli-binary-format.

• base64
• raw-in-base64-out

--no-cli-pager (boolean)

Disable cli pager for output.

--cli-auto-prompt (boolean)

Automatically prompt for CLI input parameters.

--no-cli-auto-prompt (boolean)

Disable automatically prompt for CLI input parameters.

--cli-error-format (string)

The formatting style for error output. By default, errors are displayed in enhanced format.

• legacy
• json
• yaml
• text
• table
• enhanced

Output

nodes -> (list)

The page of nodes matching the request. This is the paginated collection.

Constraints:

• min: 0
• max: 1000

(structure)

A node in the context graph representing a service, resource, or remote service.

nodeId -> (string)

The unique identifier of the node within the context graph.

Constraints:

• min: 1
• max: 256

nodeType -> (string)

Whether the node is a service, a resource, or a remote service.

Possible values:

• SERVICE
• RESOURCE
• REMOTE_SERVICE

name -> (string)

The primary display name of the node.

Constraints:

• min: 1
• max: 512

alternateNames -> (list)

Other names this node was observed under. A node that merged across sources reports one resolved name, and the names it was merged away from appear here.

Constraints:

• min: 0
• max: 50

(string)

tags -> (map)

The tags observed on the underlying resource.

Constraints:

• min: 0
• max: 50

key -> (string)

value -> (string)

nodeProperties -> (structure)

Identity attributes promoted out of the flat attribute map onto typed members.

region -> (string)

The region the node runs in. Falls back to the region the telemetry was ingested from when the node does not report one.

cloudProvider -> (string)

The cloud provider hosting the node, resolved from the reported provider, platform, or vendor namespace, and defaulting to “aws”.

sourceAccountId -> (string)

The account that produced the telemetry this node was discovered from.

namespace -> (string)

The logical service grouping the node belongs to. This is not a metric namespace.

category -> (string)

What kind of thing the node is, coarser than nodeType.

Possible values:

• GEN_AI_AGENT
• GEN_AI_MODEL
• DATABASE
• MESSAGING_QUEUE
• COMPUTE
• STORAGE
• NETWORK

stage -> (string)

The node’s deployment environment. A node may be observed in several; this is the highest-precedence one. Match any of them with NodeFilters.stage.

telemetryAttributes -> (map)

The node’s OpenTelemetry (OTel) attributes, as emitted by telemetry — the raw values, as opposed to the normalized nodeProperties . A key promoted onto a nodeProperties member is removed here, so no value appears twice.

Constraints:

• min: 0
• max: 100

key -> (string)

value -> (string)

operationDetails -> (map)

The operations observed on this node, keyed by operation name. Each value lists the dimension sets that identify the metric series for that operation.

Constraints:

• min: 0
• max: 50

key -> (string)

Operation name on a context graph node (typically OTel span.name).

Constraints:

• min: 1
• max: 256

value -> (list)

Constraints:

• min: 0
• max: 200

(map)

One OTel dimension set identifying a metric series for an operation.

Constraints:

• min: 0
• max: 50

key -> (string)

OTel dimension key on an operation identifier set (e.g. “http.request.method”).

Constraints:

• min: 1
• max: 256

value -> (string)

OTel dimension value on an operation identifier set.

Constraints:

• min: 0
• max: 1024

signalTypes -> (list)

The kinds of telemetry signal observed on this node.

Constraints:

• min: 0
• max: 5

(string)

Signal enum for context graph queries.

Possible values:

• LOGS
• METRICS
• TRACES
• CONFIG
• UNKNOWN

sources -> (list)

The discovery sources that contributed this node.

Constraints:

• min: 0
• max: 20

(string)

Data source enum for context graph queries.

Possible values:

• VPC_FLOW_LOG
• CLOUDTRAIL
• IAM_POLICY
• CODE_SEMANTICS
• TELEMETRY
• AZURE_VNET_FLOW_LOG
• ELB_ACCESS_LOG
• CLOUDFRONT_ACCESS_LOG
• S3_ACCESS_LOG
• WAF_ACCESS_LOG
• AWS_INTEGRATION
• CONFIG

metadata -> (structure)

Descriptive metadata about the node. Present only when the request sets includeMetadata.

metrics -> (list)

The metrics observed on the element.

Constraints:

• min: 0
• max: 50

(structure)

A single metric observed on a context graph node.

name -> (string)

The metric name as emitted, such as “Duration”.

namespace -> (string)

DEPRECATED: read attributes[“service.namespace”] instead. Retained (deprecated) for backward compatibility with existing consumers; will be removed once they migrate. The logical service grouping the metric belongs to.

preferredStat -> (string)

The statistic to chart or alarm on, such as “p99” or “Sum”. Free-form and frequently absent.

metricType -> (string)

OTel metric kind: “gauge”, “sum”, “histogram”, “exponential_histogram”, or “summary” (CloudWatch-vended metrics carry the same kinds). Absent when the producer did not report one.

attributes -> (map)

Per-metric qualifying attributes the console uses to query this metric’s telemetry. These are the RAW, store-matching values keyed by their OTel names (“service.name”, “service.namespace”, “cloud.provider”, “cloud.account.id”, “cloud.region”, “instrumentation_scope”) — deliberately NOT the node’s normalized/merged identity, so the query selectors match the emitted series. A merged node can carry different values per metric, which is why they live here rather than on the node.

Constraints:

• min: 0
• max: 50

key -> (string)

value -> (string)

semantics -> (structure)

What the metric means and the unit it is reported in.

description -> (string)

Human-readable description of what the metric measures.

unit -> (string)

The unit the metric is reported in.

semantics -> (structure)

Semantic description of the node. Absent on an edge, because semantics describe a service rather than a relationship.

purpose -> (string)

What the service does.

language -> (string)

The primary programming language the service is written in.

framework -> (string)

The application framework the service is built on.

kind -> (string)

The kind of workload the service is.

repository -> (string)

The source repository the service is built from.

logs -> (list)

Per-signal LOGS query selectors: a LIST of blocks the console ORs, each an AND of exact store column -> raw values. Node-level (edges carry only traces). Populated when the request sets includeMetadata; derived labels (logSourceType) are added by the service projection, not stored here.

Constraints:

• min: 0
• max: 10

(structure)

One LOGS query selector block on a node. The attributes map’s keys are AND’d; each selects with col = value . Deliberately RAW/un-normalized so the selector matches the store, not the node’s merged identity.

attributes -> (map)

One LOGS query-selector block: EXACT store column -> raw SCALAR value (mirroring the scalar MetadataAttributeMap). Keyed by the store column that carries the value (e.g. resource.attributes['service.name'] , attributes['aws.local.service'] , @logGroupName ) so the selector matches the emitted signal. A dimension seen under several values (a service under two namespaces, several log groups) becomes several blocks with the same columns and different values, which the console ORs. Dedicated to the LOGS selector so its cap evolves independently of the metric attribute map and the TRACES map. Selector caps are deliberately DISTINCT from the metric caps.

Constraints:

• min: 0
• max: 10

key -> (string)

value -> (string)

traces -> (list)

Per-signal TRACES query selectors (same block shape as logs). Present on both node and edge metadata. serviceName is derived at the service projection, not stored here.

Constraints:

• min: 0
• max: 10

(structure)

One TRACES query selector block on a node/edge (see LogMetadata).

attributes -> (map)

TRACES counterpart of LogMetadataAttributeMap — a dedicated per-signal map so the two evolve independently (same scalar shape and cap today).

Constraints:

• min: 0
• max: 10

key -> (string)

value -> (string)

firstObservedAt -> (timestamp)

When this node was first observed (UTC), at minute granularity. For a node that merged across sources, this is the earliest value any source reported.

lastObservedAt -> (timestamp)

When this node was most recently observed (UTC), at minute granularity. For a node that merged across sources, this is the latest value any source reported.

edges -> (list)

Outbound edges originating from this node. Each edge carries its from .

Constraints:

• min: 0
• max: 5000

(structure)

A directed edge in the context graph connecting two nodes.

edgeId -> (string)

The unique identifier of the edge within the context graph.

Constraints:

• min: 1
• max: 256

from -> (string)

The node identifier the edge originates from.

Constraints:

• min: 1
• max: 256

to -> (string)

The node identifier the edge points to.

Constraints:

• min: 1
• max: 256

edgeType -> (string)

The kind of relationship the edge represents.

Possible values:

• CALLS
• ACCESSES
• RUNS_ON

operations -> (list)

The operations observed on this edge.

Constraints:

• min: 0
• max: 50

(string)

edgeProperties -> (structure)

Attributes promoted out of the flat attribute map onto typed members. Which members are present depends on what produced the edge.

protocol -> (string)

The IANA protocol name for the observed network traffic, such as “tcp”.

sourcePort -> (string)

The source port of the observed traffic. May be a placeholder when the port is unknown.

destinationPort -> (string)

The destination port of the observed traffic. May be a placeholder when the port is unknown.

blocked -> (boolean)

Whether the observed network flow was denied. Absent means the edge was not derived from network flow data, which is not the same as allowed.

errorCode -> (string)

The error code returned when the call was attempted and refused. Its presence means the edge exists but the dependency is failing.

httpStatusCode -> (string)

The HTTP status code observed on the request. Distinct from errorCode.

httpMethod -> (string)

The HTTP method observed on the request.

serviceInitiated -> (boolean)

Whether the caller was an AWS service principal rather than a user or role. Absent means the edge was not derived from a source that reports it.

trafficStats -> (structure)

Traffic counters accumulated over the edge’s observation window.

bytes -> (long)

Total bytes observed across the edge.

Constraints:

• min: 0

packets -> (long)

Total packets observed across the edge.

Constraints:

• min: 0

flows -> (long)

Total network flows observed across the edge.

Constraints:

• min: 0

sentBytes -> (long)

Total bytes sent to the destination.

Constraints:

• min: 0

receivedBytes -> (long)

Total bytes received from the destination.

Constraints:

• min: 0

telemetryAttributes -> (map)

The edge’s OpenTelemetry (OTel) attributes, as emitted by telemetry. A key promoted onto an edgeProperties member is removed here, so no value appears twice.

Constraints:

• min: 0
• max: 100

key -> (string)

value -> (string)

signalTypes -> (list)

The kinds of telemetry signal observed on this edge.

Constraints:

• min: 0
• max: 5

(string)

Signal enum for context graph queries.

Possible values:

• LOGS
• METRICS
• TRACES
• CONFIG
• UNKNOWN

sources -> (list)

The discovery sources that contributed this edge.

Constraints:

• min: 0
• max: 20

(string)

Data source enum for context graph queries.

Possible values:

• VPC_FLOW_LOG
• CLOUDTRAIL
• IAM_POLICY
• CODE_SEMANTICS
• TELEMETRY
• AZURE_VNET_FLOW_LOG
• ELB_ACCESS_LOG
• CLOUDFRONT_ACCESS_LOG
• S3_ACCESS_LOG
• WAF_ACCESS_LOG
• AWS_INTEGRATION
• CONFIG

metadata -> (structure)

Descriptive metadata about the edge. Present only when the request sets includeMetadata.

metrics -> (list)

The metrics observed on the element.

Constraints:

• min: 0
• max: 50

(structure)

A single metric observed on a context graph node.

name -> (string)

The metric name as emitted, such as “Duration”.

namespace -> (string)

DEPRECATED: read attributes[“service.namespace”] instead. Retained (deprecated) for backward compatibility with existing consumers; will be removed once they migrate. The logical service grouping the metric belongs to.

preferredStat -> (string)

The statistic to chart or alarm on, such as “p99” or “Sum”. Free-form and frequently absent.

metricType -> (string)

OTel metric kind: “gauge”, “sum”, “histogram”, “exponential_histogram”, or “summary” (CloudWatch-vended metrics carry the same kinds). Absent when the producer did not report one.

attributes -> (map)

Per-metric qualifying attributes the console uses to query this metric’s telemetry. These are the RAW, store-matching values keyed by their OTel names (“service.name”, “service.namespace”, “cloud.provider”, “cloud.account.id”, “cloud.region”, “instrumentation_scope”) — deliberately NOT the node’s normalized/merged identity, so the query selectors match the emitted series. A merged node can carry different values per metric, which is why they live here rather than on the node.

Constraints:

• min: 0
• max: 50

key -> (string)

value -> (string)

semantics -> (structure)

What the metric means and the unit it is reported in.

description -> (string)

Human-readable description of what the metric measures.

unit -> (string)

The unit the metric is reported in.

semantics -> (structure)

Semantic description of the node. Absent on an edge, because semantics describe a service rather than a relationship.

purpose -> (string)

What the service does.

language -> (string)

The primary programming language the service is written in.

framework -> (string)

The application framework the service is built on.

kind -> (string)

The kind of workload the service is.

repository -> (string)

The source repository the service is built from.

logs -> (list)

Per-signal LOGS query selectors: a LIST of blocks the console ORs, each an AND of exact store column -> raw values. Node-level (edges carry only traces). Populated when the request sets includeMetadata; derived labels (logSourceType) are added by the service projection, not stored here.

Constraints:

• min: 0
• max: 10

(structure)

One LOGS query selector block on a node. The attributes map’s keys are AND’d; each selects with col = value . Deliberately RAW/un-normalized so the selector matches the store, not the node’s merged identity.

attributes -> (map)

One LOGS query-selector block: EXACT store column -> raw SCALAR value (mirroring the scalar MetadataAttributeMap). Keyed by the store column that carries the value (e.g. resource.attributes['service.name'] , attributes['aws.local.service'] , @logGroupName ) so the selector matches the emitted signal. A dimension seen under several values (a service under two namespaces, several log groups) becomes several blocks with the same columns and different values, which the console ORs. Dedicated to the LOGS selector so its cap evolves independently of the metric attribute map and the TRACES map. Selector caps are deliberately DISTINCT from the metric caps.

Constraints:

• min: 0
• max: 10

key -> (string)

value -> (string)

traces -> (list)

Per-signal TRACES query selectors (same block shape as logs). Present on both node and edge metadata. serviceName is derived at the service projection, not stored here.

Constraints:

• min: 0
• max: 10

(structure)

One TRACES query selector block on a node/edge (see LogMetadata).

attributes -> (map)

TRACES counterpart of LogMetadataAttributeMap — a dedicated per-signal map so the two evolve independently (same scalar shape and cap today).

Constraints:

• min: 0
• max: 10

key -> (string)

value -> (string)

firstObservedAt -> (timestamp)

When this edge was first observed (UTC), at minute granularity. For an edge that merged across sources, this is the earliest value any source reported.

lastObservedAt -> (timestamp)

When this edge was most recently observed (UTC), at minute granularity. For an edge that merged across sources, this is the latest value any source reported.

nextToken -> (string)

Pagination token for the next page; absent when there are no more results.

Constraints:

• min: 1
• max: 2048