scheduled_queries

Creates, updates, deletes, gets or lists a scheduled_queries resource.

Overview

Name	`scheduled_queries`
Type	Resource
Id	`aws.logs.scheduled_queries`

Fields

The following fields are returned by SELECT queries:

get_scheduled_query
list_scheduled_queries

Name	Datatype	Description
`name`	`string`	The name of the scheduled query.
`creation_time`	`integer (int64)`	The timestamp when the scheduled query was created.
`description`	`string`	The description of the scheduled query.
`destination_configuration`	`object`	Configuration for where query results are delivered.
`end_time_offset`	`integer (int64)`	The time offset in seconds that defines the end of the lookback period for the query.
`execution_role_arn`	`string`	The ARN of the IAM role used to execute the query and deliver results.
`last_execution_status`	`string`	The status of the most recent execution of the scheduled query. (Running, InvalidQuery, Complete, Failed, Timeout)
`last_triggered_time`	`integer (int64)`	The timestamp when the scheduled query was last executed.
`last_updated_time`	`integer (int64)`	The timestamp when the scheduled query was last updated.
`log_group_identifiers`	`array`	The log groups queried by the scheduled query.
`query_language`	`string`	The query language used by the scheduled query. (CWLI, SQL, PPL)
`query_string`	`string`	The query string executed by the scheduled query.
`schedule_end_time`	`integer (int64)`	The end time for the scheduled query in Unix epoch format.
`schedule_expression`	`string`	The cron expression that defines when the scheduled query runs.
`schedule_start_time`	`integer (int64)`	The start time for the scheduled query in Unix epoch format.
`schedule_type`	`string`	The schedule type of the scheduled query. Valid values are CUSTOMER_MANAGED and AWS_MANAGED. (CUSTOMER_MANAGED, AWS_MANAGED)
`scheduled_query_arn`	`string`	The ARN of the scheduled query.
`start_time_offset`	`integer (int64)`	The time offset in seconds that defines the lookback period for the query.
`state`	`string`	The current state of the scheduled query. (ENABLED, DISABLED)
`timezone`	`string`	The timezone used for evaluating the schedule expression.

Name	Datatype	Description
`name`	`string`	The name of the scheduled query.
`creation_time`	`integer (int64)`	The timestamp when the scheduled query was created.
`destination_configuration`	`object`	Configuration for where query results are delivered.
`last_execution_status`	`string`	The status of the most recent execution. (Running, InvalidQuery, Complete, Failed, Timeout)
`last_triggered_time`	`integer (int64)`	The timestamp when the scheduled query was last executed.
`last_updated_time`	`integer (int64)`	The timestamp when the scheduled query was last updated.
`schedule_expression`	`string`	The cron expression that defines when the scheduled query runs.
`schedule_type`	`string`	The schedule type of the scheduled query. Valid values are CUSTOMER_MANAGED and AWS_MANAGED. (CUSTOMER_MANAGED, AWS_MANAGED)
`scheduled_query_arn`	`string`	The ARN of the scheduled query.
`state`	`string`	The current state of the scheduled query. (ENABLED, DISABLED)
`timezone`	`string`	The timezone used for evaluating the schedule expression.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Description
`get_scheduled_query`	`select`	`region`	Retrieves details about a specific scheduled query, including its configuration, execution status, and metadata.
`list_scheduled_queries`	`select`	`region`	Lists all scheduled queries in your account and region. You can filter results by state to show only enabled or disabled queries.
`create_scheduled_query`	`insert`	`region`, `name`, `queryLanguage`, `queryString`, `scheduleExpression`, `executionRoleArn`	Creates a scheduled query that runs CloudWatch Logs Insights queries at regular intervals. Scheduled queries enable proactive monitoring by automatically executing queries to detect patterns and anomalies in your log data. Query results can be delivered to Amazon S3 for analysis or further processing.
`update_scheduled_query`	`update`	`region`, `identifier`, `queryLanguage`, `queryString`, `scheduleExpression`, `executionRoleArn`	Updates an existing scheduled query with new configuration. This operation uses PUT semantics, allowing modification of query parameters, schedule, and destinations.
`delete_scheduled_query`	`delete`	`region`	Deletes a scheduled query and stops all future executions. This operation also removes any configured actions and associated resources.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`region`	`string`	AWS region (default: us-east-1)

`SELECT` examples

get_scheduled_query
list_scheduled_queries

Retrieves details about a specific scheduled query, including its configuration, execution status, and metadata.

SELECT
name,
creation_time,
description,
destination_configuration,
end_time_offset,
execution_role_arn,
last_execution_status,
last_triggered_time,
last_updated_time,
log_group_identifiers,
query_language,
query_string,
schedule_end_time,
schedule_expression,
schedule_start_time,
schedule_type,
scheduled_query_arn,
start_time_offset,
state,
timezone
FROM aws.logs.scheduled_queries
WHERE region = '{{ region }}' -- required
;

Lists all scheduled queries in your account and region. You can filter results by state to show only enabled or disabled queries.

SELECT
name,
creation_time,
destination_configuration,
last_execution_status,
last_triggered_time,
last_updated_time,
schedule_expression,
schedule_type,
scheduled_query_arn,
state,
timezone
FROM aws.logs.scheduled_queries
WHERE region = '{{ region }}' -- required
;

`INSERT` examples

create_scheduled_query
Manifest

Creates a scheduled query that runs CloudWatch Logs Insights queries at regular intervals. Scheduled queries enable proactive monitoring by automatically executing queries to detect patterns and anomalies in your log data. Query results can be delivered to Amazon S3 for analysis or further processing.

INSERT INTO aws.logs.scheduled_queries (
name,
description,
queryLanguage,
queryString,
logGroupIdentifiers,
scheduleExpression,
timezone,
startTimeOffset,
endTimeOffset,
destinationConfiguration,
scheduleStartTime,
scheduleEndTime,
executionRoleArn,
state,
tags,
region
)
SELECT 
'{{ name }}' /* required */,
'{{ description }}',
'{{ queryLanguage }}' /* required */,
'{{ queryString }}' /* required */,
'{{ logGroupIdentifiers }}',
'{{ scheduleExpression }}' /* required */,
'{{ timezone }}',
{{ startTimeOffset }},
{{ endTimeOffset }},
'{{ destinationConfiguration }}',
{{ scheduleStartTime }},
{{ scheduleEndTime }},
'{{ executionRoleArn }}' /* required */,
'{{ state }}',
'{{ tags }}',
'{{ region }}'
RETURNING
scheduled_query_arn,
state
;

# Description fields are for documentation purposes
- name: scheduled_queries
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the scheduled_queries resource.
  - name: name
    value: "{{ name }}"
    description: |
      The name of the scheduled query. The name must be unique within your account and region. Length must be between 1 and 300 characters.
  - name: description
    value: "{{ description }}"
    description: |
      An optional description for the scheduled query to help identify its purpose and functionality.
  - name: queryLanguage
    value: "{{ queryLanguage }}"
    description: |
      The query language to use for the scheduled query. Valid values are CWLI, PPL, and SQL.
    valid_values: ['CWLI', 'SQL', 'PPL']
  - name: queryString
    value: "{{ queryString }}"
    description: |
      The query string to execute. This is the same query syntax used in CloudWatch Logs Insights. Maximum length is 10,000 characters.
  - name: logGroupIdentifiers
    value:
      - "{{ logGroupIdentifiers }}"
    description: |
      An array of log group names or ARNs to query. You can specify between 1 and 50 log groups. Log groups can be identified by name or full ARN.
  - name: scheduleExpression
    value: "{{ scheduleExpression }}"
    description: |
      A cron expression that defines when the scheduled query runs. The expression uses standard cron syntax and supports minute-level precision. Maximum length is 256 characters.
  - name: timezone
    value: "{{ timezone }}"
    description: |
      The timezone for evaluating the schedule expression. This determines when the scheduled query executes relative to the specified timezone.
  - name: startTimeOffset
    value: {{ startTimeOffset }}
    description: |
      The time offset in seconds that defines the lookback period for the query. This determines how far back in time the query searches from the execution time.
  - name: endTimeOffset
    value: {{ endTimeOffset }}
    description: |
      The time offset in seconds that defines the end of the lookback period for the query. Together with startTimeOffset, this determines the time window relative to the execution time over which the query runs.
  - name: destinationConfiguration
    description: |
      Configuration for where to deliver query results. Supports Amazon S3 destinations for storing query output and lookup table destinations for automatically refreshing lookup tables with query results. You can configure one or both destination types.
    value:
      s3Configuration:
        destinationIdentifier: "{{ destinationIdentifier }}"
        roleArn: "{{ roleArn }}"
        ownerAccountId: "{{ ownerAccountId }}"
        kmsKeyId: "{{ kmsKeyId }}"
      lookupTableConfiguration:
        tableName: "{{ tableName }}"
        roleArn: "{{ roleArn }}"
        description: "{{ description }}"
        kmsKeyId: "{{ kmsKeyId }}"
        tags: "{{ tags }}"
  - name: scheduleStartTime
    value: {{ scheduleStartTime }}
    description: |
      The start time for the scheduled query in Unix epoch format. The query will not execute before this time.
  - name: scheduleEndTime
    value: {{ scheduleEndTime }}
    description: |
      The end time for the scheduled query in Unix epoch format. The query will stop executing after this time.
  - name: executionRoleArn
    value: "{{ executionRoleArn }}"
    description: |
      The ARN of the IAM role that grants permissions to execute the query and deliver results to the specified destination. The role must have permissions to read from the specified log groups and write to the destination.
  - name: state
    value: "{{ state }}"
    description: |
      The initial state of the scheduled query. Valid values are ENABLED and DISABLED. Default is ENABLED.
    valid_values: ['ENABLED', 'DISABLED']
  - name: tags
    value: "{{ tags }}"
    description: |
      Key-value pairs to associate with the scheduled query for resource management and cost allocation.

`UPDATE` examples

update_scheduled_query

Updates an existing scheduled query with new configuration. This operation uses PUT semantics, allowing modification of query parameters, schedule, and destinations.

UPDATE aws.logs.scheduled_queries
SET 
identifier = '{{ identifier }}',
description = '{{ description }}',
queryLanguage = '{{ queryLanguage }}',
queryString = '{{ queryString }}',
logGroupIdentifiers = '{{ logGroupIdentifiers }}',
scheduleExpression = '{{ scheduleExpression }}',
timezone = '{{ timezone }}',
startTimeOffset = {{ startTimeOffset }},
endTimeOffset = {{ endTimeOffset }},
destinationConfiguration = '{{ destinationConfiguration }}',
scheduleStartTime = {{ scheduleStartTime }},
scheduleEndTime = {{ scheduleEndTime }},
executionRoleArn = '{{ executionRoleArn }}',
state = '{{ state }}'
WHERE 
region = '{{ region }}' --required
AND identifier = '{{ identifier }}' --required
AND queryLanguage = '{{ queryLanguage }}' --required
AND queryString = '{{ queryString }}' --required
AND scheduleExpression = '{{ scheduleExpression }}' --required
AND executionRoleArn = '{{ executionRoleArn }}' --required
RETURNING
name,
creation_time,
description,
destination_configuration,
end_time_offset,
execution_role_arn,
last_execution_status,
last_triggered_time,
last_updated_time,
log_group_identifiers,
query_language,
query_string,
schedule_end_time,
schedule_expression,
schedule_start_time,
schedule_type,
scheduled_query_arn,
start_time_offset,
state,
timezone;

`DELETE` examples

delete_scheduled_query

Deletes a scheduled query and stops all future executions. This operation also removes any configured actions and associated resources.

DELETE FROM aws.logs.scheduled_queries
WHERE region = '{{ region }}' --required
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

INSERT examples​

UPDATE examples​

DELETE examples​