aws-cdk-lib.aws_logs.QueryStringProps

QueryStringProps Struct

Properties for a QueryString.

QueryStringProps

used as props by

• QueryString

Source

aws-logs/lib/query-definition.ts

Type last changed

v2.208.0 · 29 Jul 2025

Example

new logs.QueryDefinition(this, 'QueryDefinition', {
  queryDefinitionName: 'MyQuery',
  queryString: new logs.QueryString({
    fields: ['@timestamp', '@message'],
    parseStatements: [
      '@message "[*] *" as loggingType, loggingMessage',
      '@message "<*>: *" as differentLoggingType, differentLoggingMessage',
    ],
    filterStatements: [
      'loggingType = "ERROR"',
      'loggingMessage = "A very strange error occurred!"',
    ],
    statsStatements: [
      'count(loggingMessage) as loggingErrors',
      'count(differentLoggingMessage) as differentLoggingErrors',
    ],
    sort: '@timestamp desc',
    limit: 20,
  }),
});

Properties

displaystringdisplaystrdisplayStringDisplaystringDisplay*string#

Specifies which fields to display in the query results.

Default: no display in QueryString

fieldsstring[]fieldstyping.List[str]fieldsList<String>Fieldsstring[]Fields*[]*string#

Retrieves the specified fields from log events for display.

Default: no fields in QueryString

filterstringfilterstrfilterStringFilterstringFilter*stringdeprecated#

Use `filterStatements` instead

Default: no filter in QueryString

filterStatementsstring[]filter_statementstyping.List[str]filterStatementsList<String>FilterStatementsstring[]FilterStatements*[]*string#

An array of one or more statements for filtering the results of a query based on a boolean expression.

Default: no filter in QueryString

Each provided statement generates a separate filter line in the query string.

Note: If provided, this property overrides any value provided for the filter property.

limitnumberlimitint | floatlimitNumberLimitdoubleLimit*float64#

Specifies the number of log events returned by the query.

Default: no limit in QueryString

parsestringparsestrparseStringParsestringParse*stringdeprecated#

Use `parseStatements` instead

Default: no parse in QueryString

parseStatementsstring[]parse_statementstyping.List[str]parseStatementsList<String>ParseStatementsstring[]ParseStatements*[]*string#

An array of one or more statements for parsing data from a log field and creating ephemeral fields that can be processed further in the query.

Default: no parse in QueryString

Each provided statement generates a separate parse line in the query string.

Note: If provided, this property overrides any value provided for the parse property.

sortstringsortstrsortStringSortstringSort*string#

Sorts the retrieved log events.

Default: no sort in QueryString

statsstringstatsstrstatsStringStatsstringStats*stringdeprecated#

Use `statsStatements` instead

Default: no stats in QueryString

statsStatementsstring[]stats_statementstyping.List[str]statsStatementsList<String>StatsStatementsstring[]StatsStatements*[]*string#

An array of one or more statements for calculating aggregate statistics.

Default: no stats in QueryString

notes

CloudWatch Logs Insights supports up to two stats commands in a single query. Each provided statement generates a separate stats line in the query string.

Note: If provided, this property overrides any value provided for the stats property.