lookup_tables

Creates, updates, deletes, gets or lists a lookup_tables resource.

Overview

Name	lookup_tables
Type	Resource
Id	aws.logs.lookup_tables

Fields

The following fields are returned by SELECT queries:

get_lookup_table

Name	Datatype	Description
description	string	The description of the lookup table.
kms_key_id	string	The ARN of the KMS key used to encrypt the lookup table data, if applicable.
last_updated_time	integer (int64)	The time when the lookup table was last updated, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
lookup_table_arn	string	The ARN of the lookup table.
lookup_table_name	string	The name of the lookup table. (pattern: <code>^[a-zA-Z0-9_]+$</code>)
size_bytes	integer (int64)	The size of the lookup table in bytes.
table_body	string	The full CSV content of the lookup table.

describe_lookup_tables

Name	Datatype	Description
lookup_tables	array	An array of structures, where each structure contains metadata about one lookup table.
next_token	string	The token for the next set of items to return. The token expires after 24 hours.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_lookup_table	select	region		Retrieves the full content of a lookup table, including the CSV data.
describe_lookup_tables	select	region		Retrieves metadata about lookup tables in your account. You can optionally filter the results by table name prefix. Results are sorted by table name in ascending order.
create_lookup_table	insert	region, lookupTableName		Creates a lookup table by uploading CSV data or from CloudWatch Logs query results. You can use lookup tables to enrich log data in CloudWatch Logs queries with reference data such as user details, application names, or error descriptions. The table name must be unique within your account and Region. You must specify either tableBody or queryId, but not both. If you use tableBody, the CSV content must include a header row with column names, use UTF-8 encoding, and not exceed 10 MB.
update_lookup_table	update	region, lookupTableArn		Updates an existing lookup table by replacing all of its content with new CSV data or CloudWatch Logs query results. After the update completes, queries that use this table use the new data. This is a full replacement operation. All existing content is replaced. You must specify either tableBody or queryId, but not both.
delete_lookup_table	delete	region		Deletes a lookup table permanently. This operation cannot be undone. Queries that reference a deleted table will return an error. Before deleting a lookup table, review any saved queries or dashboards that may reference it.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_lookup_table

Retrieves the full content of a lookup table, including the CSV data.

SELECT
description,
kms_key_id,
last_updated_time,
lookup_table_arn,
lookup_table_name,
size_bytes,
table_body
FROM aws.logs.lookup_tables
WHERE region = '{{ region }}' -- required
;

describe_lookup_tables

Retrieves metadata about lookup tables in your account. You can optionally filter the results by table name prefix. Results are sorted by table name in ascending order.

SELECT
lookup_tables,
next_token
FROM aws.logs.lookup_tables
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_lookup_table

Creates a lookup table by uploading CSV data or from CloudWatch Logs query results. You can use lookup tables to enrich log data in CloudWatch Logs queries with reference data such as user details, application names, or error descriptions. The table name must be unique within your account and Region. You must specify either tableBody or queryId, but not both. If you use tableBody, the CSV content must include a header row with column names, use UTF-8 encoding, and not exceed 10 MB.

INSERT INTO aws.logs.lookup_tables (
lookupTableName,
description,
tableBody,
queryId,
kmsKeyId,
tags,
region
)
SELECT 
'{{ lookupTableName }}' /* required */,
'{{ description }}',
'{{ tableBody }}',
'{{ queryId }}',
'{{ kmsKeyId }}',
'{{ tags }}',
'{{ region }}'
RETURNING
created_at,
lookup_table_arn
;

Manifest

# Description fields are for documentation purposes
- name: lookup_tables
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the lookup_tables resource.
  - name: lookupTableName
    value: "{{ lookupTableName }}"
    description: |
      The name of the lookup table. The name must be unique within your account and Region. The name can contain only alphanumeric characters and underscores, and can be up to 256 characters long.
  - name: description
    value: "{{ description }}"
    description: |
      A description of the lookup table. The description can be up to 1024 characters long.
  - name: tableBody
    value: "{{ tableBody }}"
    description: |
      The CSV content of the lookup table. The first row must be a header row with column names. The content must use UTF-8 encoding and not exceed 10 MB. You must specify either tableBody or queryId, but not both.
  - name: queryId
    value: "{{ queryId }}"
    description: |
      The ID of a completed or cancelled CloudWatch Logs query whose results populate the lookup table. A cancelled query populates the table with the partial results that were available when the query was stopped. You must specify either tableBody or queryId, but not both.
  - name: kmsKeyId
    value: "{{ kmsKeyId }}"
    description: |
      The ARN of the KMS key to use to encrypt the lookup table data. If you don't specify a key, the data is encrypted with an Amazon Web Services-owned key.
  - name: tags
    value: "{{ tags }}"
    description: |
      A list of key-value pairs to associate with the lookup table. You can associate as many as 50 tags with a lookup table. Tags can help you organize and categorize your resources.

UPDATE examples

update_lookup_table

Updates an existing lookup table by replacing all of its content with new CSV data or CloudWatch Logs query results. After the update completes, queries that use this table use the new data. This is a full replacement operation. All existing content is replaced. You must specify either tableBody or queryId, but not both.

UPDATE aws.logs.lookup_tables
SET 
lookupTableArn = '{{ lookupTableArn }}',
description = '{{ description }}',
tableBody = '{{ tableBody }}',
queryId = '{{ queryId }}',
kmsKeyId = '{{ kmsKeyId }}'
WHERE 
region = '{{ region }}' --required
AND lookupTableArn = '{{ lookupTableArn }}' --required
RETURNING
last_updated_time,
lookup_table_arn;

DELETE examples

delete_lookup_table

Deletes a lookup table permanently. This operation cannot be undone. Queries that reference a deleted table will return an error. Before deleting a lookup table, review any saved queries or dashboards that may reference it.

DELETE FROM aws.logs.lookup_tables
WHERE region = '{{ region }}' --required
;