Amazon CloudWatch Logs

2015/05/07 - Amazon CloudWatch Logs - 14 new api methods

CreateLogGroup (new) Link ¶

Creates a new log group with the specified name. The name of the log group must be unique within a region for an AWS account. You can create up to 500 log groups per account.

You must use the following guidelines when naming a log group:

  • Log group names can be between 1 and 512 characters long.

  • Allowed characters are a-z, A-Z, 0-9, '_' (underscore), '-' (hyphen), '/' (forward slash), and '.' (period).

Request Syntax

client.create_log_group(
    logGroupName='string'
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

returns:

None

DescribeLogStreams (new) Link ¶

Returns all the log streams that are associated with the specified log group. The list returned in the response is ASCII-sorted by log stream name.

By default, this operation returns up to 50 log streams. If there are more log streams to list, the response would contain a nextToken value in the response body. You can also limit the number of log streams returned in the response by specifying the limit parameter in the request. This operation has a limit of five transactions per second, after which transactions are throttled.

Request Syntax

client.describe_log_streams(
    logGroupName='string',
    logStreamNamePrefix='string',
    orderBy='LogStreamName'|'LastEventTime',
    descending=True|False,
    nextToken='string',
    limit=123
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

type logStreamNamePrefix:

string

param logStreamNamePrefix:

Will only return log streams that match the provided logStreamNamePrefix. If you don't specify a value, no prefix filter is applied.

type orderBy:

string

param orderBy:

Specifies what to order the returned log streams by. Valid arguments are 'LogStreamName' or 'LastEventTime'. If you don't specify a value, results are ordered by LogStreamName. If 'LastEventTime' is chosen, the request cannot also contain a logStreamNamePrefix.

type descending:

boolean

param descending:

If set to true, results are returned in descending order. If you don't specify a value or set it to false, results are returned in ascending order.

type nextToken:

string

param nextToken:

A string token used for pagination that points to the next page of results. It must be a value obtained from the response of the previous DescribeLogStreams request.

type limit:

integer

param limit:

The maximum number of items returned in the response. If you don't specify a value, the request would return up to 50 items.

rtype:

dict

returns:

Response Syntax

{
    'logStreams': [
        {
            'logStreamName': 'string',
            'creationTime': 123,
            'firstEventTimestamp': 123,
            'lastEventTimestamp': 123,
            'lastIngestionTime': 123,
            'uploadSequenceToken': 'string',
            'arn': 'string',
            'storedBytes': 123
        },
    ],
    'nextToken': 'string'
}

Response Structure

  • (dict) --

    • logStreams (list) -- A list of log streams.

      • (dict) -- A log stream is sequence of log events that share the same emitter.

        • logStreamName (string) --

        • creationTime (integer) -- A point in time expressed as the number milliseconds since Jan 1, 1970 00:00:00 UTC.

        • firstEventTimestamp (integer) -- A point in time expressed as the number milliseconds since Jan 1, 1970 00:00:00 UTC.

        • lastEventTimestamp (integer) -- A point in time expressed as the number milliseconds since Jan 1, 1970 00:00:00 UTC.

        • lastIngestionTime (integer) -- A point in time expressed as the number milliseconds since Jan 1, 1970 00:00:00 UTC.

        • uploadSequenceToken (string) -- A string token used for making PutLogEvents requests. A sequenceToken can only be used once, and PutLogEvents requests must include the sequenceToken obtained from the response of the previous request.

        • arn (string) --

        • storedBytes (integer) --

    • nextToken (string) -- A string token used for pagination that points to the next page of results. It must be a value obtained from the response of the previous request. The token expires after 24 hours.

DeleteLogGroup (new) Link ¶

Deletes the log group with the specified name and permanently deletes all the archived log events associated with it.

Request Syntax

client.delete_log_group(
    logGroupName='string'
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

returns:

None

DeleteLogStream (new) Link ¶

Deletes a log stream and permanently deletes all the archived log events associated with it.

Request Syntax

client.delete_log_stream(
    logGroupName='string',
    logStreamName='string'
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

type logStreamName:

string

param logStreamName:

[REQUIRED]

returns:

None

DescribeLogGroups (new) Link ¶

Returns all the log groups that are associated with the AWS account making the request. The list returned in the response is ASCII-sorted by log group name.

By default, this operation returns up to 50 log groups. If there are more log groups to list, the response would contain a nextToken value in the response body. You can also limit the number of log groups returned in the response by specifying the limit parameter in the request.

Request Syntax

client.describe_log_groups(
    logGroupNamePrefix='string',
    nextToken='string',
    limit=123
)
type logGroupNamePrefix:

string

param logGroupNamePrefix:

type nextToken:

string

param nextToken:

A string token used for pagination that points to the next page of results. It must be a value obtained from the response of the previous DescribeLogGroups request.

type limit:

integer

param limit:

The maximum number of items returned in the response. If you don't specify a value, the request would return up to 50 items.

rtype:

dict

returns:

Response Syntax

{
    'logGroups': [
        {
            'logGroupName': 'string',
            'creationTime': 123,
            'retentionInDays': 123,
            'metricFilterCount': 123,
            'arn': 'string',
            'storedBytes': 123
        },
    ],
    'nextToken': 'string'
}

Response Structure

  • (dict) --

    • logGroups (list) -- A list of log groups.

      • (dict) --

        • logGroupName (string) --

        • creationTime (integer) -- A point in time expressed as the number milliseconds since Jan 1, 1970 00:00:00 UTC.

        • retentionInDays (integer) -- Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653.

        • metricFilterCount (integer) -- The number of metric filters associated with the log group.

        • arn (string) --

        • storedBytes (integer) --

    • nextToken (string) -- A string token used for pagination that points to the next page of results. It must be a value obtained from the response of the previous request. The token expires after 24 hours.

DeleteMetricFilter (new) Link ¶

Deletes a metric filter associated with the specified log group.

Request Syntax

client.delete_metric_filter(
    logGroupName='string',
    filterName='string'
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

type filterName:

string

param filterName:

[REQUIRED] The name of the metric filter.

returns:

None

DeleteRetentionPolicy (new) Link ¶

Deletes the retention policy of the specified log group. Log events would not expire if they belong to log groups without a retention policy.

Request Syntax

client.delete_retention_policy(
    logGroupName='string'
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

returns:

None

PutMetricFilter (new) Link ¶

Creates or updates a metric filter and associates it with the specified log group. Metric filters allow you to configure rules to extract metric data from log events ingested through PutLogEvents requests.

Request Syntax

client.put_metric_filter(
    logGroupName='string',
    filterName='string',
    filterPattern='string',
    metricTransformations=[
        {
            'metricName': 'string',
            'metricNamespace': 'string',
            'metricValue': 'string'
        },
    ]
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

type filterName:

string

param filterName:

[REQUIRED] The name of the metric filter.

type filterPattern:

string

param filterPattern:

[REQUIRED] A symbolic description of how Amazon CloudWatch Logs should interpret the data in each log entry. For example, a log entry may contain timestamps, IP addresses, strings, and so on. You use the pattern to specify what to look for in the log stream.

type metricTransformations:

list

param metricTransformations:

[REQUIRED]

  • (dict) --

    • metricName (string) -- [REQUIRED] The name of the CloudWatch metric to which the monitored log information should be published. For example, you may publish to a metric called ErrorCount.

    • metricNamespace (string) -- [REQUIRED] The destination namespace of the new CloudWatch metric.

    • metricValue (string) -- [REQUIRED] What to publish to the metric. For example, if you're counting the occurrences of a particular term like "Error", the value will be "1" for each occurrence. If you're counting the bytes transferred the published value will be the value in the log event.

returns:

None

TestMetricFilter (new) Link ¶

Tests the filter pattern of a metric filter against a sample of log event messages. You can use this operation to validate the correctness of a metric filter pattern.

Request Syntax

client.test_metric_filter(
    filterPattern='string',
    logEventMessages=[
        'string',
    ]
)
type filterPattern:

string

param filterPattern:

[REQUIRED] A symbolic description of how Amazon CloudWatch Logs should interpret the data in each log entry. For example, a log entry may contain timestamps, IP addresses, strings, and so on. You use the pattern to specify what to look for in the log stream.

type logEventMessages:

list

param logEventMessages:

[REQUIRED]

  • (string) --

rtype:

dict

returns:

Response Syntax

{
    'matches': [
        {
            'eventNumber': 123,
            'eventMessage': 'string',
            'extractedValues': {
                'string': 'string'
            }
        },
    ]
}

Response Structure

  • (dict) --

    • matches (list) --

      • (dict) --

        • eventNumber (integer) --

        • eventMessage (string) --

        • extractedValues (dict) --

          • (string) --

            • (string) --

CreateLogStream (new) Link ¶

Creates a new log stream in the specified log group. The name of the log stream must be unique within the log group. There is no limit on the number of log streams that can exist in a log group.

You must use the following guidelines when naming a log stream:

  • Log stream names can be between 1 and 512 characters long.

  • The ':' colon character is not allowed.

Request Syntax

client.create_log_stream(
    logGroupName='string',
    logStreamName='string'
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

type logStreamName:

string

param logStreamName:

[REQUIRED]

returns:

None

DescribeMetricFilters (new) Link ¶

Returns all the metrics filters associated with the specified log group. The list returned in the response is ASCII-sorted by filter name.

By default, this operation returns up to 50 metric filters. If there are more metric filters to list, the response would contain a nextToken value in the response body. You can also limit the number of metric filters returned in the response by specifying the limit parameter in the request.

Request Syntax

client.describe_metric_filters(
    logGroupName='string',
    filterNamePrefix='string',
    nextToken='string',
    limit=123
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

type filterNamePrefix:

string

param filterNamePrefix:

The name of the metric filter.

type nextToken:

string

param nextToken:

A string token used for pagination that points to the next page of results. It must be a value obtained from the response of the previous DescribeMetricFilters request.

type limit:

integer

param limit:

The maximum number of items returned in the response. If you don't specify a value, the request would return up to 50 items.

rtype:

dict

returns:

Response Syntax

{
    'metricFilters': [
        {
            'filterName': 'string',
            'filterPattern': 'string',
            'metricTransformations': [
                {
                    'metricName': 'string',
                    'metricNamespace': 'string',
                    'metricValue': 'string'
                },
            ],
            'creationTime': 123
        },
    ],
    'nextToken': 'string'
}

Response Structure

  • (dict) --

    • metricFilters (list) --

      • (dict) -- Metric filters can be used to express how Amazon CloudWatch Logs would extract metric observations from ingested log events and transform them to metric data in a CloudWatch metric.

        • filterName (string) -- The name of the metric filter.

        • filterPattern (string) -- A symbolic description of how Amazon CloudWatch Logs should interpret the data in each log entry. For example, a log entry may contain timestamps, IP addresses, strings, and so on. You use the pattern to specify what to look for in the log stream.

        • metricTransformations (list) --

          • (dict) --

            • metricName (string) -- The name of the CloudWatch metric to which the monitored log information should be published. For example, you may publish to a metric called ErrorCount.

            • metricNamespace (string) -- The destination namespace of the new CloudWatch metric.

            • metricValue (string) -- What to publish to the metric. For example, if you're counting the occurrences of a particular term like "Error", the value will be "1" for each occurrence. If you're counting the bytes transferred the published value will be the value in the log event.

        • creationTime (integer) -- A point in time expressed as the number milliseconds since Jan 1, 1970 00:00:00 UTC.

    • nextToken (string) -- A string token used for pagination that points to the next page of results. It must be a value obtained from the response of the previous request. The token expires after 24 hours.

PutRetentionPolicy (new) Link ¶

Sets the retention of the specified log group. A retention policy allows you to configure the number of days you want to retain log events in the specified log group.

Request Syntax

client.put_retention_policy(
    logGroupName='string',
    retentionInDays=123
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

type retentionInDays:

integer

param retentionInDays:

[REQUIRED] Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653.

returns:

None

PutLogEvents (new) Link ¶

Uploads a batch of log events to the specified log stream.

Every PutLogEvents request must include the sequenceToken obtained from the response of the previous request. An upload in a newly created log stream does not require a sequenceToken.

The batch of events must satisfy the following constraints:

  • The maximum batch size is 1,048,576 bytes, and this size is calculated as the sum of all event messages in UTF-8, plus 26 bytes for each log event.

  • None of the log events in the batch can be more than 2 hours in the future.

  • None of the log events in the batch can be older than 14 days or the retention period of the log group.

  • The log events in the batch must be in chronological ordered by their timestamp.

  • The maximum number of log events in a batch is 10,000.

Request Syntax

client.put_log_events(
    logGroupName='string',
    logStreamName='string',
    logEvents=[
        {
            'timestamp': 123,
            'message': 'string'
        },
    ],
    sequenceToken='string'
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

type logStreamName:

string

param logStreamName:

[REQUIRED]

type logEvents:

list

param logEvents:

[REQUIRED] A list of events belonging to a log stream.

  • (dict) -- A log event is a record of some activity that was recorded by the application or resource being monitored. The log event record that Amazon CloudWatch Logs understands contains two properties: the timestamp of when the event occurred, and the raw event message.

    • timestamp (integer) -- [REQUIRED] A point in time expressed as the number milliseconds since Jan 1, 1970 00:00:00 UTC.

    • message (string) -- [REQUIRED]

type sequenceToken:

string

param sequenceToken:

A string token that must be obtained from the response of the previous PutLogEvents request.

rtype:

dict

returns:

Response Syntax

{
    'nextSequenceToken': 'string',
    'rejectedLogEventsInfo': {
        'tooNewLogEventStartIndex': 123,
        'tooOldLogEventEndIndex': 123,
        'expiredLogEventEndIndex': 123
    }
}

Response Structure

  • (dict) --

    • nextSequenceToken (string) -- A string token used for making PutLogEvents requests. A sequenceToken can only be used once, and PutLogEvents requests must include the sequenceToken obtained from the response of the previous request.

    • rejectedLogEventsInfo (dict) --

      • tooNewLogEventStartIndex (integer) --

      • tooOldLogEventEndIndex (integer) --

      • expiredLogEventEndIndex (integer) --

GetLogEvents (new) Link ¶

Retrieves log events from the specified log stream. You can provide an optional time range to filter the results on the event timestamp.

By default, this operation returns as much log events as can fit in a response size of 1MB, up to 10,000 log events. The response will always include a nextForwardToken and a nextBackwardToken in the response body. You can use any of these tokens in subsequent GetLogEvents requests to paginate through events in either forward or backward direction. You can also limit the number of log events returned in the response by specifying the limit parameter in the request.

Request Syntax

client.get_log_events(
    logGroupName='string',
    logStreamName='string',
    startTime=123,
    endTime=123,
    nextToken='string',
    limit=123,
    startFromHead=True|False
)
type logGroupName:

string

param logGroupName:

[REQUIRED]

type logStreamName:

string

param logStreamName:

[REQUIRED]

type startTime:

integer

param startTime:

A point in time expressed as the number milliseconds since Jan 1, 1970 00:00:00 UTC.

type endTime:

integer

param endTime:

A point in time expressed as the number milliseconds since Jan 1, 1970 00:00:00 UTC.

type nextToken:

string

param nextToken:

A string token used for pagination that points to the next page of results. It must be a value obtained from the nextForwardToken or nextBackwardToken fields in the response of the previous GetLogEvents request.

type limit:

integer

param limit:

The maximum number of log events returned in the response. If you don't specify a value, the request would return as much log events as can fit in a response size of 1MB, up to 10,000 log events.

type startFromHead:

boolean

param startFromHead:

If set to true, the earliest log events would be returned first. The default is false (the latest log events are returned first).

rtype:

dict

returns:

Response Syntax

{
    'events': [
        {
            'timestamp': 123,
            'message': 'string',
            'ingestionTime': 123
        },
    ],
    'nextForwardToken': 'string',
    'nextBackwardToken': 'string'
}

Response Structure

  • (dict) --

    • events (list) --

      • (dict) --

        • timestamp (integer) -- A point in time expressed as the number milliseconds since Jan 1, 1970 00:00:00 UTC.

        • message (string) --

        • ingestionTime (integer) -- A point in time expressed as the number milliseconds since Jan 1, 1970 00:00:00 UTC.

    • nextForwardToken (string) -- A string token used for pagination that points to the next page of results. It must be a value obtained from the response of the previous request. The token expires after 24 hours.

    • nextBackwardToken (string) -- A string token used for pagination that points to the next page of results. It must be a value obtained from the response of the previous request. The token expires after 24 hours.