GetLogGroupFields

Returns a list of the fields that are included in log events in the specified log group. Includes the percentage of log events that contain each field. The search is limited to a time period that you specify.

You can specify the log group to search by using either logGroupIdentifier or logGroupName. You must specify one of these parameters, but you can't specify both.

In the results, fields that start with @ are fields generated by CloudWatch Logs. For example, @timestamp is the timestamp of each log event. For more information about the fields that are generated by CloudWatch logs, see Supported Logs and Discovered Fields.

The response results are sorted by the frequency percentage, starting with the highest percentage.

If you are using CloudWatch cross-account observability, you can use this operation in a monitoring account and view data from the linked source accounts. For more information, see CloudWatch cross-account observability.

Request Syntax

{
   "logGroupIdentifier": "string",
   "logGroupName": "string",
   "time": number
}

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters.

The request accepts the following data in JSON format.

Response Syntax

{
   "logGroupFields": [ 
      { 
         "name": "string",
         "percent": number
      }
   ]
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

Errors

For information about the errors that are common to all actions, see Common Errors.

Examples

Retrieve fields found in log events in a log group

The following example lists the log events and how often they occur in MyLogGroup for the 15 minutes before November 1, 2018, 00:00:00UTC.

Sample Request

POST / HTTP/1.1
Host: logs.<region>.<domain>
X-Amz-Date: <DATE>
Authorization: AWS4-HMAC-SHA256 Credential=<Credential>, SignedHeaders=content-type;date;host;user-agent;x-amz-date;x-amz-target;x-amzn-requestid, Signature=<Signature>
User-Agent: <UserAgentString>
Accept: application/json
Content-Type: application/x-amz-json-1.1
Content-Length: <PayloadSizeBytes>
Connection: Keep-Alive
X-Amz-Target: Logs_20140328.GetLogGroupFields
{
   "logGroupName": "MyLogGroup",
   "time": 1541030400
}

Sample Response

HTTP/1.1 200 OK
x-amzn-RequestId: <RequestId>
Content-Type: application/x-amz-json-1.1
Content-Length: <PayloadSizeBytes>
Date: <Date>
{
    "logGroupFields": [
        {
            "name": "@timestamp",
            "percent": 100
        },
        {
            "name": "@message",
            "percent": 100
        },
        {
            "name": "@logStream",
            "percent": 100
        },
        {
            "name": "type",
            "percent": 57
        },
        {
            "name": "duration",
            "percent": 13
        }
    ]
}

Example

The following example lists the log events and how often they occur in MyLogGroup for the 15 minutes before November 1, 2018, 00:00:00UTC.

Sample Request

{
  "logGroupIdentifier": "arn:aws:logs:us-east-1:123456789012:log-group:monitoring-logGroup-1234:*",
  "time": 1541030400
}

Sample Response

{
    "logGroupFields": [
    {
        "name": "@timestamp",
        "percent": 100
    },
    {
      "name": "@message",
      "percent": 100
    },
    {
       "name": "@logStream",
       "percent": 100
    },
    {
       "name": "type",
       "percent": 57
    },
    {
       "name": "duration",
       "percent": 13
   }
] }

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: