AWS::Logs::QueryDefinition

Creates a query definition for CloudWatch Logs Insights. For more information, see Analyzing Log Data with CloudWatch Logs Insights.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::Logs::QueryDefinition",
  "Properties" : {
      "LogGroupNames" : [ String, ... ],
      "Name" : String,
      "QueryString" : String
    }
}

YAML

Type: AWS::Logs::QueryDefinition
Properties:
  LogGroupNames: 
    - String
  Name: String
  QueryString: 
    String

Properties

LogGroupNames

Use this parameter if you want the query to query only certain log groups.

Required: No

Type: Array of String

Update requires: No interruption

Name

A name for the query definition.

Note

You can use the name to create a folder structure for your queries. To create a folder, use a forward slash (/) to prefix your desired query name with your desired folder name. For example, /folder-name/query-name .

Required: Yes

Type: String

Minimum: 1

Maximum: 255

Update requires: No interruption

QueryString

The query string to use for this query definition. For more information, see CloudWatch Logs Insights Query Syntax.

Required: Yes

Type: String

Minimum: 1

Maximum: 10000

Update requires: No interruption

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the query definition ID.

For more information about using the Ref function, see Ref.

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

QueryDefinitionId

The ID of the query definition.

Examples

Query definition example

The following example creates a query definition.

JSON

"myQueryDefinition": {
  "Type": "AWS::Logs::QueryDefinition",
  "Properties": {
    "Name": "myQueryName",
    "QueryString": "fields @timestamp, @message | sort @timestamp desc | limit 20"
    }
}

YAML

myQueryDefinition:
  Type: AWS::Logs::QueryDefinition
  Properties:
    Name: "myQueryName"
    QueryString: “fields @timestamp, @message | sort @timestamp desc | limit 20"