Amazon CloudWatch Logs

{'indexCategories': ['DEFAULT | CUSTOM | AUTO | INACTIVE']}

{'fieldIndexes': {'indexCategory': 'DEFAULT | CUSTOM | AUTO | INACTIVE'}}

Returns a list of field indexes discovered in log data. By default, the response includes the DEFAULT, CUSTOM, and INACTIVE index categories. To return indexes from other categories, use the indexCategories parameter.

For more information about field index policies, see PutIndexPolicy.

See also: AWS API Documentation

Request Syntax

client.describe_field_indexes(
    logGroupIdentifiers=[
        'string',
    ],
    indexCategories=[
        'DEFAULT'|'CUSTOM'|'AUTO'|'INACTIVE',
    ],
    nextToken='string'
)

type logGroupIdentifiers:

list

param logGroupIdentifiers:

[REQUIRED]

An array containing the names or ARNs of the log groups that you want to retrieve field indexes for.

• (string) --

type indexCategories:

list

param indexCategories:

The index categories to return. The following values are supported:

• DEFAULT: Fields that CloudWatch Logs indexes by default. Examples include @logStream and @data_format.

• CUSTOM: Fields that you added manually to the field index policy. CloudWatch Logs always indexes these fields. These fields count toward the quota of 20 fields for each log group.

• AUTO: Fields that CloudWatch Logs indexes automatically based on your query patterns and usage. These fields do not count toward the field index quota. CloudWatch Logs might update these fields based on changes in your query patterns. To keep a field indexed permanently, add it to an account-level or log-group level field index policy.

• INACTIVE: Fields that CloudWatch Logs indexed before but does not index now. This happens if you remove a field from the field index policy or if CloudWatch Logs automatically selects a different field based on your queries.

If you omit this parameter, the response includes the DEFAULT, CUSTOM, and INACTIVE categories.

For more information about automatically indexed fields and using the AUTO category, see Automatically indexed fields.

• (string) --

type nextToken:

string

param nextToken:

The token for the next set of items to return. The token expires after 24 hours.

rtype:

dict

returns:

Response Syntax

{
    'fieldIndexes': [
        {
            'logGroupIdentifier': 'string',
            'fieldIndexName': 'string',
            'lastScanTime': 123,
            'firstEventTime': 123,
            'lastEventTime': 123,
            'type': 'FACET'|'FIELD_INDEX',
            'indexCategory': 'DEFAULT'|'CUSTOM'|'AUTO'|'INACTIVE'
        },
    ],
    'nextToken': 'string'
}

Response Structure

• (dict) --

  • fieldIndexes (list) --

    An array containing the field index information.

    • (dict) --

      This structure describes one log event field that is used as an index in at least one index policy in this account.

      • logGroupIdentifier (string) --

        If this field index appears in an index policy that applies only to a single log group, the ARN of that log group is displayed here.

      • fieldIndexName (string) --

        The string that this field index matches.

      • lastScanTime (integer) --

        The most recent time that CloudWatch Logs scanned ingested log events to search for this field index to improve the speed of future CloudWatch Logs Insights queries that search for this field index.

      • firstEventTime (integer) --

        The time and date of the earliest log event that matches this field index, after the index policy that contains it was created.

      • lastEventTime (integer) --

        The time and date of the most recent log event that matches this field index.

      • type (string) --

        The type of index. Specify FACET for facet-based indexing or FIELD_INDEX for field-based indexing. This determines how the field is indexed and can be queried.

      • indexCategory (string) --

        The category of the field index:

        • DEFAULT: Fields that CloudWatch Logs indexes by default. Examples include @logStream and @data_format.

        • CUSTOM: Fields that you added manually to the field index policy. CloudWatch Logs always indexes these fields. These fields count toward the quota of 20 fields for each log group.

        • AUTO: Fields that CloudWatch Logs indexes automatically based on your query patterns and usage. These fields do not count toward the field index quota. CloudWatch Logs might update these fields based on changes in your query patterns. To keep a field indexed permanently, add it to an account-level or log-group level field index policy.

        • INACTIVE: Fields that CloudWatch Logs indexed before but does not index now. This happens if you remove a field from the field index policy or if CloudWatch Logs automatically selects a different field based on your queries.

        For more information about automatically indexed fields, see Automatically indexed fields.

  • nextToken (string) --

    The token for the next set of items to return. The token expires after 24 hours.