subscription_filters

Creates, updates, deletes, gets or lists a subscription_filters resource.

Overview

Name	subscription_filters
Type	Resource
Id	aws.logs.subscription_filters

Fields

The following fields are returned by SELECT queries:

describe_subscription_filters

Name	Datatype	Description
apply_on_transformed_logs	boolean	This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see PutTransformer. If this value is true, the subscription filter is applied on the transformed version of the log events instead of the original ingested log events.
creation_time	integer (int64)	The creation time of the subscription filter, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.
destination_arn	string	The Amazon Resource Name (ARN) of the destination.
distribution	string	The method used to distribute log data to the destination, which can be either random or grouped by log stream. (Random, ByLogStream)
emit_system_fields	array	The list of system fields that are included in the log events sent to the subscription destination. Returns the emitSystemFields value if it was specified when the subscription filter was created.
field_selection_criteria	string	The filter expression that specifies which log events are processed by this subscription filter based on system fields. Returns the fieldSelectionCriteria value if it was specified when the subscription filter was created.
filter_name	string	The name of the subscription filter. (pattern: <code>[^:]</code>)
filter_pattern	string	A symbolic description of how CloudWatch Logs should interpret the data in each log event. For example, a log event can contain timestamps, IP addresses, strings, and so on. You use the filter pattern to specify what to look for in the log event message.
log_group_name	string	The name of the log group. (pattern: <code>[.-_/#A-Za-z0-9]+</code>)
role_arn	string

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_subscription_filters	select	region		Lists the subscription filters for the specified log group. You can list all the subscription filters or filter the results by prefix. The results are ASCII-sorted by filter name.
put_subscription_filter	replace	region, logGroupName, filterName, filterPattern, destinationArn		Creates or updates a subscription filter and associates it with the specified log group. With subscription filters, you can subscribe to a real-time stream of log events ingested through PutLogEvents and have them delivered to a specific destination. When log events are sent to the receiving service, they are Base64 encoded and compressed with the GZIP format. The following destinations are supported for subscription filters: An Amazon Kinesis data stream belonging to the same account as the subscription filter, for same-account delivery. A logical destination created with PutDestination that belongs to a different account, for cross-account delivery. We currently support Kinesis Data Streams and Firehose as logical destinations. An Amazon Kinesis Data Firehose delivery stream that belongs to the same account as the subscription filter, for same-account delivery. An Lambda function that belongs to the same account as the subscription filter, for same-account delivery. Each log group can have up to two subscription filters associated with it. If you are updating an existing filter, you must specify the correct name in filterName. Using regular expressions in filter patterns is supported. For these filters, there is a quotas of quota of two regular expression patterns within a single filter pattern. There is also a quota of five regular expression patterns per log group. For more information about using regular expressions in filter patterns, see Filter pattern syntax for metric filters, subscription filters, filter log events, and Live Tail. To perform a PutSubscriptionFilter operation for any destination except a Lambda function, you must also have the iam:PassRole permission.
delete_subscription_filter	delete	region		Deletes the specified subscription filter.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_subscription_filters

Lists the subscription filters for the specified log group. You can list all the subscription filters or filter the results by prefix. The results are ASCII-sorted by filter name.

SELECT
apply_on_transformed_logs,
creation_time,
destination_arn,
distribution,
emit_system_fields,
field_selection_criteria,
filter_name,
filter_pattern,
log_group_name,
role_arn
FROM aws.logs.subscription_filters
WHERE region = '{{ region }}' -- required
;

REPLACE examples

put_subscription_filter

Creates or updates a subscription filter and associates it with the specified log group. With subscription filters, you can subscribe to a real-time stream of log events ingested through PutLogEvents and have them delivered to a specific destination. When log events are sent to the receiving service, they are Base64 encoded and compressed with the GZIP format. The following destinations are supported for subscription filters: An Amazon Kinesis data stream belonging to the same account as the subscription filter, for same-account delivery. A logical destination created with PutDestination that belongs to a different account, for cross-account delivery. We currently support Kinesis Data Streams and Firehose as logical destinations. An Amazon Kinesis Data Firehose delivery stream that belongs to the same account as the subscription filter, for same-account delivery. An Lambda function that belongs to the same account as the subscription filter, for same-account delivery. Each log group can have up to two subscription filters associated with it. If you are updating an existing filter, you must specify the correct name in filterName. Using regular expressions in filter patterns is supported. For these filters, there is a quotas of quota of two regular expression patterns within a single filter pattern. There is also a quota of five regular expression patterns per log group. For more information about using regular expressions in filter patterns, see Filter pattern syntax for metric filters, subscription filters, filter log events, and Live Tail. To perform a PutSubscriptionFilter operation for any destination except a Lambda function, you must also have the iam:PassRole permission.

REPLACE aws.logs.subscription_filters
SET 
logGroupName = '{{ logGroupName }}',
filterName = '{{ filterName }}',
filterPattern = '{{ filterPattern }}',
destinationArn = '{{ destinationArn }}',
roleArn = '{{ roleArn }}',
distribution = '{{ distribution }}',
applyOnTransformedLogs = {{ applyOnTransformedLogs }},
fieldSelectionCriteria = '{{ fieldSelectionCriteria }}',
emitSystemFields = '{{ emitSystemFields }}'
WHERE 
region = '{{ region }}' --required
AND logGroupName = '{{ logGroupName }}' --required
AND filterName = '{{ filterName }}' --required
AND filterPattern = '{{ filterPattern }}' --required
AND destinationArn = '{{ destinationArn }}' --required;

DELETE examples

delete_subscription_filter

Deletes the specified subscription filter.

DELETE FROM aws.logs.subscription_filters
WHERE region = '{{ region }}' --required
;