Skip to content
AWS for Query.Farm

aws.logs.describe_metric_filters

Example SQL Queries

SELECT * FROM
aws.logs.describe_metric_filters;

Description

Lists the specified metric filters. You can list all of the metric filters or filter the results by log name, prefix, metric name, or metric namespace. The results are ASCII-sorted by filter name.

Table Definition

Column NameColumn Data Type
filter_name_prefix Input Column

The prefix to match. CloudWatch Logs uses the value that you set here only if you also include the logGroupName parameter in your request.

VARCHAR
log_group_name Input Column

The name of the log group.

VARCHAR
metric_name Input Column

Filters results to include only those with the specified metric name. If you include this parameter in your request, you must also include the metricNamespace parameter.

VARCHAR
metric_namespace Input Column

Filters results to include only those in the specified namespace. If you include this parameter in your request, you must also include the metricName parameter.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
creation_time

The creation time of the metric filter, expressed as the number of milliseconds after Jan 1, 1970 00:00:00 UTC.

BIGINT
filter_name

The name of the metric filter.

VARCHAR
filter_pattern

A symbolic description of how CloudWatch Logs should interpret the data in each log event. For example, a log event can contain timestamps, IP addresses, strings, and so on. You use the filter pattern to specify what to look for in the log event message.

VARCHAR
metric_transformations

The metric transformations.

STRUCT(
    "metric_name" VARCHAR,
    "metric_namespace" VARCHAR,
    "metric_value" VARCHAR,
    "default_value" DOUBLE,
    "dimensions" MAP(VARCHAR, VARCHAR),
    "unit" VARCHAR
)[]
Show child fields
metric_transformations[]
Show child fields
metric_transformations[].default_value

(Optional) The value to emit when a filter pattern does not match a log event. This value can be null.

metric_transformations[].dimensions

The fields to use as dimensions for the metric. One metric filter can include as many as three dimensions.

Metrics extracted from log events are charged as custom metrics. To prevent unexpected high charges, do not specify high-cardinality fields such as IPAddress or requestID as dimensions. Each different value found for a dimension is treated as a separate metric and accrues charges as a separate custom metric.

CloudWatch Logs disables a metric filter if it generates 1000 different name/value pairs for your specified dimensions within a certain amount of time. This helps to prevent accidental high charges.

You can also set up a billing alarm to alert you if your charges are higher than expected. For more information, see Creating a Billing Alarm to Monitor Your Estimated Amazon Web Services Charges.

metric_transformations[].metric_name

The name of the CloudWatch metric.

metric_transformations[].metric_namespace

A custom namespace to contain your metric in CloudWatch. Use namespaces to group together metrics that are similar. For more information, see Namespaces.

metric_transformations[].metric_value

The value to publish to the CloudWatch metric when a filter pattern matches a log event.

metric_transformations[].unit

The unit to assign to the metric. If you omit this, the unit is set as None.