anomalies

Creates, updates, deletes, gets or lists an anomalies resource.

Overview

Name	anomalies
Type	Resource
Id	aws.logs.anomalies

Fields

The following fields are returned by SELECT queries:

list_anomalies

Name	Datatype	Description
active	boolean	Specifies whether this anomaly is still ongoing.
anomaly_detector_arn	string	The ARN of the anomaly detector that identified this anomaly. (pattern: <code>[\w#+=/:,.@-]*</code>)
anomaly_id	string	The unique ID that CloudWatch Logs assigned to this anomaly.
description	string	A human-readable description of the anomaly. This description is generated by CloudWatch Logs.
first_seen	integer (int64)	The date and time when the anomaly detector first saw this anomaly. It is specified as epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.
histogram	object	A map showing times when the anomaly detector ran, and the number of occurrences of this anomaly that were detected at each of those runs. The times are specified in epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.
is_pattern_level_suppression	boolean	If this anomaly is suppressed, this field is true if the suppression is because the pattern is suppressed. If false, then only this particular anomaly is suppressed.
last_seen	integer (int64)	The date and time when the anomaly detector most recently saw this anomaly. It is specified as epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.
log_group_arn_list	array	An array of ARNS of the log groups that contained log events considered to be part of this anomaly.
log_samples	array	An array of sample log event messages that are considered to be part of this anomaly.
pattern_id	string	The ID of the pattern used to help identify this anomaly.
pattern_regex	string	The pattern used to help identify this anomaly, in regular expression format.
pattern_string	string	The pattern used to help identify this anomaly, in string format.
pattern_tokens	array	An array of structures where each structure contains information about one token that makes up the pattern.
priority	string	The priority level of this anomaly, as determined by CloudWatch Logs. Priority is computed based on log severity labels such as FATAL and ERROR and the amount of deviation from the baseline. Possible values are HIGH, MEDIUM, and LOW.
state	string	Indicates the current state of this anomaly. If it is still being treated as an anomaly, the value is Active. If you have suppressed this anomaly by using the UpdateAnomaly operation, the value is Suppressed. If this behavior is now considered to be normal, the value is Baseline. (Active, Suppressed, Baseline)
suppressed	boolean	Indicates whether this anomaly is currently suppressed. To suppress an anomaly, use UpdateAnomaly.
suppressed_date	integer (int64)	If the anomaly is suppressed, this indicates when it was suppressed.
suppressed_until	integer (int64)	If the anomaly is suppressed, this indicates when the suppression will end. If this value is 0, the anomaly was suppressed with no expiration, with the INFINITE value.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_anomalies	select	region		Returns a list of anomalies that log anomaly detectors have found. For details about the structure format of each anomaly object that is returned, see the example in this section.
update_anomaly	update	region, anomalyDetectorArn		Use this operation to suppress anomaly detection for a specified anomaly or pattern. If you suppress an anomaly, CloudWatch Logs won't report new occurrences of that anomaly and won't update that anomaly with new data. If you suppress a pattern, CloudWatch Logs won't report any anomalies related to that pattern. You must specify either anomalyId or patternId, but you can't specify both parameters in the same operation. If you have previously used this operation to suppress detection of a pattern or anomaly, you can use it again to cause CloudWatch Logs to end the suppression. To do this, use this operation and specify the anomaly or pattern to stop suppressing, and omit the suppressionType and suppressionPeriod parameters.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

list_anomalies

Returns a list of anomalies that log anomaly detectors have found. For details about the structure format of each anomaly object that is returned, see the example in this section.

SELECT
active,
anomaly_detector_arn,
anomaly_id,
description,
first_seen,
histogram,
is_pattern_level_suppression,
last_seen,
log_group_arn_list,
log_samples,
pattern_id,
pattern_regex,
pattern_string,
pattern_tokens,
priority,
state,
suppressed,
suppressed_date,
suppressed_until
FROM aws.logs.anomalies
WHERE region = '{{ region }}' -- required
;

UPDATE examples

update_anomaly

Use this operation to suppress anomaly detection for a specified anomaly or pattern. If you suppress an anomaly, CloudWatch Logs won't report new occurrences of that anomaly and won't update that anomaly with new data. If you suppress a pattern, CloudWatch Logs won't report any anomalies related to that pattern. You must specify either anomalyId or patternId, but you can't specify both parameters in the same operation. If you have previously used this operation to suppress detection of a pattern or anomaly, you can use it again to cause CloudWatch Logs to end the suppression. To do this, use this operation and specify the anomaly or pattern to stop suppressing, and omit the suppressionType and suppressionPeriod parameters.

UPDATE aws.logs.anomalies
SET 
anomalyId = '{{ anomalyId }}',
patternId = '{{ patternId }}',
anomalyDetectorArn = '{{ anomalyDetectorArn }}',
suppressionType = '{{ suppressionType }}',
suppressionPeriod = '{{ suppressionPeriod }}',
baseline = {{ baseline }}
WHERE 
region = '{{ region }}' --required
AND anomalyDetectorArn = '{{ anomalyDetectorArn }}' --required;