# GetLogGroupFields
<a name="API_GetLogGroupFields"></a>

Returns a list of the fields that are included in log events in the specified log group. Includes the percentage of log events that contain each field. The search is limited to a time period that you specify.

This operation is used for discovering fields within log group events. For discovering fields across data sources, use the GetLogFields operation.

You can specify the log group to search by using either `logGroupIdentifier` or `logGroupName`. You must specify one of these parameters, but you can't specify both. 

In the results, fields that start with `@` are fields generated by CloudWatch Logs. For example, `@timestamp` is the timestamp of each log event. For more information about the fields that are generated by CloudWatch logs, see [Supported Logs and Discovered Fields](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData-discoverable-fields.html).

The response results are sorted by the frequency percentage, starting with the highest percentage.

If you are using CloudWatch cross-account observability, you can use this operation in a monitoring account and view data from the linked source accounts. For more information, see [CloudWatch cross-account observability](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account.html).

## Request Syntax
<a name="API_GetLogGroupFields_RequestSyntax"></a>

```
{
   "logGroupIdentifier": "string",
   "logGroupName": "string",
   "time": number
}
```

## Request Parameters
<a name="API_GetLogGroupFields_RequestParameters"></a>

For information about the parameters that are common to all actions, see [Common Parameters](CommonParameters.md).

The request accepts the following data in JSON format.

 ** [logGroupIdentifier](#API_GetLogGroupFields_RequestSyntax) **   <a name="CWL-GetLogGroupFields-request-logGroupIdentifier"></a>
Specify either the name or ARN of the log group to view. If the log group is in a source account and you are using a monitoring account, you must specify the ARN.  
 You must include either `logGroupIdentifier` or `logGroupName`, but not both. 
Type: String  
Length Constraints: Minimum length of 1. Maximum length of 2048.  
Pattern: `[\w#+=/:,.@-]*`   
Required: No

 ** [logGroupName](#API_GetLogGroupFields_RequestSyntax) **   <a name="CWL-GetLogGroupFields-request-logGroupName"></a>
The name of the log group to search.  
 You must include either `logGroupIdentifier` or `logGroupName`, but not both. 
Type: String  
Length Constraints: Minimum length of 1. Maximum length of 512.  
Pattern: `[\.\-_/#A-Za-z0-9]+`   
Required: No

 ** [time](#API_GetLogGroupFields_RequestSyntax) **   <a name="CWL-GetLogGroupFields-request-time"></a>
The time to set as the center of the query. If you specify `time`, the 8 minutes before and 8 minutes after this time are searched. If you omit `time`, the most recent 15 minutes up to the current time are searched.  
The `time` value is specified as epoch time, which is the number of seconds since `January 1, 1970, 00:00:00 UTC`.  
Type: Long  
Valid Range: Minimum value of 0.  
Required: No

## Response Syntax
<a name="API_GetLogGroupFields_ResponseSyntax"></a>

```
{
   "logGroupFields": [ 
      { 
         "name": "string",
         "percent": number
      }
   ]
}
```

## Response Elements
<a name="API_GetLogGroupFields_ResponseElements"></a>

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

 ** [logGroupFields](#API_GetLogGroupFields_ResponseSyntax) **   <a name="CWL-GetLogGroupFields-response-logGroupFields"></a>
The array of fields found in the query. Each object in the array contains the name of the field, along with the percentage of time it appeared in the log events that were queried.  
Type: Array of [LogGroupField](API_LogGroupField.md) objects

## Errors
<a name="API_GetLogGroupFields_Errors"></a>

For information about the errors that are common to all actions, see [Common Error Types](CommonErrors.md).

 ** InvalidParameterException **   
A parameter is specified incorrectly.  
HTTP Status Code: 400

 ** LimitExceededException **   
You have reached the maximum number of resources that can be created.  
HTTP Status Code: 400

 ** ResourceNotFoundException **   
The specified resource does not exist.  
HTTP Status Code: 400

 ** ServiceUnavailableException **   
The service cannot complete the request.  
HTTP Status Code: 500

## Examples
<a name="API_GetLogGroupFields_Examples"></a>

### Retrieve fields found in log events in a log group
<a name="API_GetLogGroupFields_Example_1"></a>

The following example lists the log events and how often they occur in `MyLogGroup` for the 15 minutes before November 1, 2018, 00:00:00UTC.

#### Sample Request
<a name="API_GetLogGroupFields_Example_1_Request"></a>

```
POST / HTTP/1.1
Host: logs.<region>.<domain>
X-Amz-Date: <DATE>
Authorization: AWS4-HMAC-SHA256 Credential=<Credential>, SignedHeaders=content-type;date;host;user-agent;x-amz-date;x-amz-target;x-amzn-requestid, Signature=<Signature>
User-Agent: <UserAgentString>
Accept: application/json
Content-Type: application/x-amz-json-1.1
Content-Length: <PayloadSizeBytes>
Connection: Keep-Alive
X-Amz-Target: Logs_20140328.GetLogGroupFields
{
   "logGroupName": "MyLogGroup",
   "time": 1541030400
}
```

#### Sample Response
<a name="API_GetLogGroupFields_Example_1_Response"></a>

```
HTTP/1.1 200 OK
x-amzn-RequestId: <RequestId>
Content-Type: application/x-amz-json-1.1
Content-Length: <PayloadSizeBytes>
Date: <Date>
{
    "logGroupFields": [
        {
            "name": "@timestamp",
            "percent": 100
        },
        {
            "name": "@message",
            "percent": 100
        },
        {
            "name": "@logStream",
            "percent": 100
        },
        {
            "name": "type",
            "percent": 57
        },
        {
            "name": "duration",
            "percent": 13
        }
    ]
}
```

### Example
<a name="API_GetLogGroupFields_Example_2"></a>

The following example lists the log events and how often they occur in `MyLogGroup` for the 15 minutes before November 1, 2018, 00:00:00UTC.

#### Sample Request
<a name="API_GetLogGroupFields_Example_2_Request"></a>

```
{
  "logGroupIdentifier": "arn:aws:logs:us-east-1:123456789012:log-group:monitoring-logGroup-1234:*",
  "time": 1541030400
}
```

#### Sample Response
<a name="API_GetLogGroupFields_Example_2_Response"></a>

```
{
    "logGroupFields": [
    {
        "name": "@timestamp",
        "percent": 100
    },
    {
      "name": "@message",
      "percent": 100
    },
    {
       "name": "@logStream",
       "percent": 100
    },
    {
       "name": "type",
       "percent": 57
    },
    {
       "name": "duration",
       "percent": 13
   }
] }
```

## See Also
<a name="API_GetLogGroupFields_SeeAlso"></a>

For more information about using this API in one of the language-specific AWS SDKs, see the following:
+  [AWS Command Line Interface V2](https://docs.aws.amazon.com/goto/cli2/logs-2014-03-28/GetLogGroupFields) 
+  [AWS SDK for .NET V4](https://docs.aws.amazon.com/goto/DotNetSDKV4/logs-2014-03-28/GetLogGroupFields) 
+  [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/logs-2014-03-28/GetLogGroupFields) 
+  [AWS SDK for Go v2](https://docs.aws.amazon.com/goto/SdkForGoV2/logs-2014-03-28/GetLogGroupFields) 
+  [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/logs-2014-03-28/GetLogGroupFields) 
+  [AWS SDK for JavaScript V3](https://docs.aws.amazon.com/goto/SdkForJavaScriptV3/logs-2014-03-28/GetLogGroupFields) 
+  [AWS SDK for Kotlin](https://docs.aws.amazon.com/goto/SdkForKotlin/logs-2014-03-28/GetLogGroupFields) 
+  [AWS SDK for PHP V3](https://docs.aws.amazon.com/goto/SdkForPHPV3/logs-2014-03-28/GetLogGroupFields) 
+  [AWS SDK for Python](https://docs.aws.amazon.com/goto/boto3/logs-2014-03-28/GetLogGroupFields) 
+  [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/logs-2014-03-28/GetLogGroupFields)