Skip to main content

log_anomaly_detectors

Creates, updates, deletes, gets or lists a log_anomaly_detectors resource.

Overview​

Namelog_anomaly_detectors
TypeResource
Idaws.logs.log_anomaly_detectors

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
anomaly_detector_statusstringSpecifies whether the anomaly detector is currently active. To change its status, use the enabled parameter in the UpdateLogAnomalyDetector operation. (INITIALIZING, TRAINING, ANALYZING, FAILED, DELETED, PAUSED)
anomaly_visibility_timeinteger (int64)The number of days used as the life cycle of anomalies. After this time, anomalies are automatically baselined and the anomaly detector model will treat new occurrences of similar event as normal.
creation_time_stampinteger (int64)The date and time when this anomaly detector was created.
detector_namestringThe name of the log anomaly detector
evaluation_frequencystringSpecifies how often the anomaly detector runs and look for anomalies. Set this value according to the frequency that the log group receives new logs. For example, if the log group receives new log events every 10 minutes, then setting evaluationFrequency to FIFTEEN_MIN might be appropriate. (ONE_MIN, FIVE_MIN, TEN_MIN, FIFTEEN_MIN, THIRTY_MIN, ONE_HOUR)
filter_patternstringA symbolic description of how CloudWatch Logs should interpret the data in each log event. For example, a log event can contain timestamps, IP addresses, strings, and so on. You use the filter pattern to specify what to look for in the log event message.
kms_key_idstringThe ARN of the KMS key assigned to this anomaly detector, if any.
last_modified_time_stampinteger (int64)The date and time when this anomaly detector was most recently modified.
log_group_arn_listarrayAn array of structures, where each structure contains the ARN of a log group associated with this anomaly detector.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
get_log_anomaly_detectorselectregionRetrieves information about the log anomaly detector that you specify. The KMS key ARN detected is valid.
list_log_anomaly_detectorsselectregionRetrieves a list of the log anomaly detectors in the account.
create_log_anomaly_detectorinsertregion, logGroupArnListCreates an anomaly detector that regularly scans one or more log groups and look for patterns and anomalies in the logs. An anomaly detector can help surface issues by automatically discovering anomalies in your log event traffic. An anomaly detector uses machine learning algorithms to scan log events and find patterns. A pattern is a shared text structure that recurs among your log fields. Patterns provide a useful tool for analyzing large sets of logs because a large number of log events can often be compressed into a few patterns. The anomaly detector uses pattern recognition to find anomalies, which are unusual log events. It uses the evaluationFrequency to compare current log events and patterns with trained baselines. Fields within a pattern are called tokens. Fields that vary within a pattern, such as a request ID or timestamp, are referred to as dynamic tokens and represented by <>. The following is an example of a pattern: [INFO] Request time: <> ms This pattern represents log events like [INFO] Request time: 327 ms and other similar log events that differ only by the number, in this csse 327. When the pattern is displayed, the different numbers are replaced by <*> Any parts of log events that are masked as sensitive data are not scanned for anomalies. For more information about masking sensitive data, see Help protect sensitive log data with masking.
update_log_anomaly_detectorupdateregion, anomalyDetectorArn, enabledUpdates an existing log anomaly detector.
delete_log_anomaly_detectordeleteregionDeletes the specified CloudWatch Logs anomaly detector.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
regionstringAWS region (default: us-east-1)

SELECT examples​

Retrieves information about the log anomaly detector that you specify. The KMS key ARN detected is valid.

SELECT
anomaly_detector_status,
anomaly_visibility_time,
creation_time_stamp,
detector_name,
evaluation_frequency,
filter_pattern,
kms_key_id,
last_modified_time_stamp,
log_group_arn_list
FROM aws.logs.log_anomaly_detectors
WHERE region = '{{ region }}' -- required
;

INSERT examples​

Creates an anomaly detector that regularly scans one or more log groups and look for patterns and anomalies in the logs. An anomaly detector can help surface issues by automatically discovering anomalies in your log event traffic. An anomaly detector uses machine learning algorithms to scan log events and find patterns. A pattern is a shared text structure that recurs among your log fields. Patterns provide a useful tool for analyzing large sets of logs because a large number of log events can often be compressed into a few patterns. The anomaly detector uses pattern recognition to find anomalies, which are unusual log events. It uses the evaluationFrequency to compare current log events and patterns with trained baselines. Fields within a pattern are called tokens. Fields that vary within a pattern, such as a request ID or timestamp, are referred to as dynamic tokens and represented by <>. The following is an example of a pattern: [INFO] Request time: <> ms This pattern represents log events like [INFO] Request time: 327 ms and other similar log events that differ only by the number, in this csse 327. When the pattern is displayed, the different numbers are replaced by <*> Any parts of log events that are masked as sensitive data are not scanned for anomalies. For more information about masking sensitive data, see Help protect sensitive log data with masking.

INSERT INTO aws.logs.log_anomaly_detectors (
logGroupArnList,
detectorName,
evaluationFrequency,
filterPattern,
kmsKeyId,
anomalyVisibilityTime,
tags,
region
)
SELECT 
'{{ logGroupArnList }}' /* required */,
'{{ detectorName }}',
'{{ evaluationFrequency }}',
'{{ filterPattern }}',
'{{ kmsKeyId }}',
{{ anomalyVisibilityTime }},
'{{ tags }}',
'{{ region }}'
RETURNING
anomaly_detector_arn
;

UPDATE examples​

Updates an existing log anomaly detector.

UPDATE aws.logs.log_anomaly_detectors
SET 
anomalyDetectorArn = '{{ anomalyDetectorArn }}',
evaluationFrequency = '{{ evaluationFrequency }}',
filterPattern = '{{ filterPattern }}',
anomalyVisibilityTime = {{ anomalyVisibilityTime }},
enabled = {{ enabled }}
WHERE 
region = '{{ region }}' --required
AND anomalyDetectorArn = '{{ anomalyDetectorArn }}' --required
AND enabled = {{ enabled }} --required;

DELETE examples​

Deletes the specified CloudWatch Logs anomaly detector.

DELETE FROM aws.logs.log_anomaly_detectors
WHERE region = '{{ region }}' --required
;
Last updated on