insights_metric_datas
Creates, updates, deletes, gets or lists an insights_metric_datas resource.
Overview
| Name | insights_metric_datas |
| Type | Resource |
| Id | aws.cloudtrail.insights_metric_datas |
Fields
The following fields are returned by SELECT queries:
- list_insights_metric_data
| Name | Datatype | Description |
|---|---|---|
error_code | string | Only returned if InsightType parameter was set to ApiErrorRateInsight. If returning metrics for the ApiErrorRateInsight Insights type, this is the error to retrieve data for. For example, AccessDenied. (pattern: <code>^[\w\d\s_.,-:[]]+$</code>) |
event_name | string | The name of the event, typically the Amazon Web Services API on which unusual levels of activity were recorded. (pattern: <code>^[A-Za-z0-9_]+$</code>) |
event_source | string | The Amazon Web Services service to which the request was made, such as iam.amazonaws.com or s3.amazonaws.com. (pattern: <code>^[a-z0-9_-]+.amazonaws.com$</code>) |
insight_type | string | The type of CloudTrail Insights event, which is either ApiCallRateInsight or ApiErrorRateInsight. The ApiCallRateInsight Insights type analyzes write-only management API calls that are aggregated per minute against a baseline API call volume. The ApiErrorRateInsight Insights type analyzes management API calls that result in error codes. (ApiCallRateInsight, ApiErrorRateInsight) |
next_token | string | Only returned if the full results could not be returned in a single query. You can set the NextToken parameter in the next request to this value to continue retrieval. |
timestamps | array | List of timestamps at intervals corresponding to the specified time period. |
trail_arn | string | Specifies the ARN of the trail. This is only returned when Insights is enabled on a trail logging data events. |
values | array | List of values representing the API call rate or error rate at each timestamp. The number of values is equal to the number of timestamps. |
Methods
The following methods are available for this resource:
| Name | Accessible by | Required Params | Optional Params | Description |
|---|---|---|---|---|
list_insights_metric_data | select | region | Returns Insights metrics data for trails that have enabled Insights. The request must include the EventSource, EventName, and InsightType parameters. If the InsightType is set to ApiErrorRateInsight, the request must also include the ErrorCode parameter. The following are the available time periods for ListInsightsMetricData. Each cutoff is inclusive. Data points with a period of 60 seconds (1-minute) are available for 15 days. Data points with a period of 300 seconds (5-minute) are available for 63 days. Data points with a period of 3600 seconds (1 hour) are available for 90 days. To use ListInsightsMetricData operation, you must have the following permissions: If ListInsightsMetricData is invoked with TrailName parameter, access to the ListInsightsMetricData API operation is linked to the cloudtrail:LookupEvents action and cloudtrail:ListInsightsData. To use this operation, you must have permissions to perform the cloudtrail:LookupEvents and cloudtrail:ListInsightsData action on the specific trail. If ListInsightsMetricData is invoked without TrailName parameter, access to the ListInsightsMetricData API operation is linked to the cloudtrail:LookupEvents action only. To use this operation, you must have permissions to perform the cloudtrail:LookupEvents action. |
Parameters
Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.
| Name | Datatype | Description |
|---|---|---|
region | string | AWS region (default: us-east-1) |
SELECT examples
- list_insights_metric_data
Returns Insights metrics data for trails that have enabled Insights. The request must include the EventSource, EventName, and InsightType parameters. If the InsightType is set to ApiErrorRateInsight, the request must also include the ErrorCode parameter. The following are the available time periods for ListInsightsMetricData. Each cutoff is inclusive. Data points with a period of 60 seconds (1-minute) are available for 15 days. Data points with a period of 300 seconds (5-minute) are available for 63 days. Data points with a period of 3600 seconds (1 hour) are available for 90 days. To use ListInsightsMetricData operation, you must have the following permissions: If ListInsightsMetricData is invoked with TrailName parameter, access to the ListInsightsMetricData API operation is linked to the cloudtrail:LookupEvents action and cloudtrail:ListInsightsData. To use this operation, you must have permissions to perform the cloudtrail:LookupEvents and cloudtrail:ListInsightsData action on the specific trail. If ListInsightsMetricData is invoked without TrailName parameter, access to the ListInsightsMetricData API operation is linked to the cloudtrail:LookupEvents action only. To use this operation, you must have permissions to perform the cloudtrail:LookupEvents action.
SELECT
error_code,
event_name,
event_source,
insight_type,
next_token,
timestamps,
trail_arn,
values
FROM aws.cloudtrail.insights_metric_datas
WHERE region = '{{ region }}' -- required
;