Creates a query definition for CloudWatch Logs Insights. For more information, see Analyzing Log Data with CloudWatch Logs Insights.
Syntax
To declare this entity in your AWS CloudFormation template, use the following syntax:
JSON
{
"Type" : "AWS::Logs::QueryDefinition",
"Properties" : {
"LogGroupNames" : [ String, ... ],
"Name" : String,
"QueryLanguage" : String,
"QueryString" : String
}
}
YAML
Type: AWS::Logs::QueryDefinition
Properties:
LogGroupNames:
- String
Name: String
QueryLanguage: String
QueryString:
String
Properties
LogGroupNames-
Use this parameter if you want the query to query only certain log groups.
Required: No
Type: Array of String
Update requires: No interruption
Name-
A name for the query definition.
Note
You can use the name to create a folder structure for your queries. To create a folder, use a forward slash (/) to prefix your desired query name with your desired folder name. For example,
folder-name/query-name.Required: Yes
Type: String
Minimum:
1Maximum:
255Update requires: No interruption
QueryLanguage-
The query language used for this query. For more information about the query languages that CloudWatch Logs supports, see Supported query languages.
Required: No
Type: String
Allowed values:
CWLI | SQL | PPLUpdate requires: No interruption
QueryString-
The query string to use for this query definition. For more information, see CloudWatch Logs Insights Query Syntax.
Required: Yes
Type: String
Minimum:
1Maximum:
10000Update requires: No interruption
Return values
Ref
When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the query definition ID.
For more information about using the Ref function, see Ref.
Fn::GetAtt
The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.
For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.
QueryDefinitionId-
The ID of the query definition.
Examples
Query definition example
The following example creates a query definition.
JSON
"myQueryDefinition": {
"Type": "AWS::Logs::QueryDefinition",
"Properties": {
"Name": "myQueryName",
"QueryString": "fields @timestamp, @message | sort @timestamp desc | limit 20"
}
}YAML
myQueryDefinition:
Type: AWS::Logs::QueryDefinition
Properties:
Name: "myQueryName"
QueryString: “fields @timestamp, @message | sort @timestamp desc | limit 20"