Skip to content
AWS for Query.Farm

aws.logs.describe_log_groups

Example SQL Queries

SELECT * FROM
aws.logs.describe_log_groups;

Description

Lists the specified log groups. You can list all your log groups or filter the results by prefix. The results are ASCII-sorted by log group name.

CloudWatch Logs doesn’t support IAM policies that control access to the DescribeLogGroups action by using the aws:ResourceTag/key-name condition key. Other CloudWatch Logs actions do support the use of the aws:ResourceTag/key-name condition key to control access. For more information about using tags to control access, see Controlling access to Amazon Web Services resources using tags.

If you are using CloudWatch cross-account observability, you can use this operation in a monitoring account and view data from the linked source accounts. For more information, see CloudWatch cross-account observability.

Table Definition

Column NameColumn Data Type
account_identifiers Input Column

When includeLinkedAccounts is set to True, use this parameter to specify the list of accounts to search. You can specify as many as 20 account IDs in the array. 

VARCHAR[]
Show child fields
account_identifiers[]
include_linked_accounts Input Column

If you are using a monitoring account, set this to True to have the operation return log groups in the accounts listed in accountIdentifiers.

If this parameter is set to true and accountIdentifiers contains a null value, the operation returns all log groups in the monitoring account and all log groups in all source accounts that are linked to the monitoring account. 

BOOLEAN
log_group_class Input Column

This specifies the log group class for this log group. There are two classes:

  • The Standard log class supports all CloudWatch Logs features.

  • The Infrequent Access log class supports a subset of CloudWatch Logs features and incurs lower costs.

For details about the features supported by each class, see Log classes 

VARCHAR
log_group_name_pattern Input Column

If you specify a string for this parameter, the operation returns only log groups that have names that match the string based on a case-sensitive substring search. For example, if you specify Foo, log groups named FooBar, aws/Foo, and GroupFoo would match, but foo, F/o/o and Froo would not match.

If you specify logGroupNamePattern in your request, then only arn, creationTime, and logGroupName are included in the response.

logGroupNamePattern and logGroupNamePrefix are mutually exclusive. Only one of these parameters can be passed. 

VARCHAR
log_group_name_prefix Input Column

The prefix to match.

logGroupNamePrefix and logGroupNamePattern are mutually exclusive. Only one of these parameters can be passed. 

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
arn

The Amazon Resource Name (ARN) of the log group. This version of the ARN includes a trailing :* after the log group name.

Use this version to refer to the ARN in IAM policies when specifying permissions for most API actions. The exception is when specifying permissions for TagResource, UntagResource, and ListTagsForResource. The permissions for those three actions require the ARN version that doesn't include a trailing :*.

VARCHAR
creation_time

The creation time of the log group, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.

BIGINT
data_protection_status

Displays whether this log group has a protection policy, or whether it had one in the past. For more information, see PutDataProtectionPolicy.

VARCHAR
inherited_properties

Displays all the properties that this log group has inherited from account-level settings.

VARCHAR[]
Show child fields
inherited_properties[]
kms_key_id

The Amazon Resource Name (ARN) of the KMS key to use when encrypting log data.

VARCHAR
log_group_arn

The Amazon Resource Name (ARN) of the log group. This version of the ARN doesn't include a trailing :* after the log group name.

Use this version to refer to the ARN in the following situations:

VARCHAR
log_group_name

The name of the log group.

VARCHAR
metric_filter_count

The number of metric filters.

BIGINT
retention_in_days

The number of days to retain the log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, and 3653.

To set a log group so that its log events do not expire, use DeleteRetentionPolicy. 

BIGINT
stored_bytes

The number of bytes stored.

BIGINT