Skip to content
AWS for Query.Farm

aws.logs.list_anomalies

Example SQL Queries

SELECT * FROM
aws.logs.list_anomalies;

Description

Returns a list of anomalies that log anomaly detectors have found. For details about the structure format of each anomaly object that is returned, see the example in this section.

Table Definition

Column NameColumn Data Type
anomaly_detector_arn Input Column

The ARN of the anomaly detector that identified this anomaly.

VARCHAR
suppression_state Input Column

You can specify this parameter if you want to the operation to return only anomalies that are currently either suppressed or unsuppressed.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
active

Specifies whether this anomaly is still ongoing.

BOOLEAN
anomaly_id

The unique ID that CloudWatch Logs assigned to this anomaly.

VARCHAR
description

A human-readable description of the anomaly. This description is generated by CloudWatch Logs.

VARCHAR
first_seen

The date and time when the anomaly detector first saw this anomaly. It is specified as epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.

BIGINT
histogram

A map showing times when the anomaly detector ran, and the number of occurrences of this anomaly that were detected at each of those runs. The times are specified in epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.

MAP(VARCHAR, BIGINT)
is_pattern_level_suppression

If this anomaly is suppressed, this field is true if the suppression is because the pattern is suppressed. If false, then only this particular anomaly is suppressed.

BOOLEAN
last_seen

The date and time when the anomaly detector most recently saw this anomaly. It is specified as epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.

BIGINT
log_group_arn_list

An array of ARNS of the log groups that contained log events considered to be part of this anomaly.

VARCHAR[]
Show child fields
log_group_arn_list[]
log_samples

An array of sample log event messages that are considered to be part of this anomaly.

STRUCT(
    "timestamp" BIGINT,
    "message" VARCHAR
)[]
Show child fields
log_samples[]
Show child fields
log_samples[].message

The message content of the log event.

log_samples[].timestamp

The time stamp of the log event.

pattern_id

The ID of the pattern used to help identify this anomaly.

VARCHAR
pattern_regex

The pattern used to help identify this anomaly, in regular expression format.

VARCHAR
pattern_string

The pattern used to help identify this anomaly, in string format.

VARCHAR
pattern_tokens

An array of structures where each structure contains information about one token that makes up the pattern.

STRUCT(
    "dynamic_token_position" BIGINT,
    "is_dynamic" BOOLEAN,
    "token_string" VARCHAR,
    "enumerations" MAP(VARCHAR, BIGINT)
)[]
Show child fields
pattern_tokens[]
Show child fields
pattern_tokens[].dynamic_token_position

For a dynamic token, this indicates where in the pattern that this token appears, related to other dynamic tokens. The dynamic token that appears first has a value of 1, the one that appears second is 2, and so on.

pattern_tokens[].enumerations

Contains the values found for a dynamic token, and the number of times each value was found.

pattern_tokens[].is_dynamic

Specifies whether this is a dynamic token.

pattern_tokens[].token_string

The string represented by this token. If this is a dynamic token, the value will be <*>

priority

The priority level of this anomaly, as determined by CloudWatch Logs. Priority is computed based on log severity labels such as FATAL and ERROR and the amount of deviation from the baseline. Possible values are HIGH, MEDIUM, and LOW.

VARCHAR
state

Indicates the current state of this anomaly. If it is still being treated as an anomaly, the value is Active. If you have suppressed this anomaly by using the UpdateAnomaly operation, the value is Suppressed. If this behavior is now considered to be normal, the value is Baseline.

VARCHAR
suppressed

Indicates whether this anomaly is currently suppressed. To suppress an anomaly, use UpdateAnomaly.

BOOLEAN
suppressed_date

If the anomaly is suppressed, this indicates when it was suppressed.

BIGINT
suppressed_until

If the anomaly is suppressed, this indicates when the suppression will end. If this value is 0, the anomaly was suppressed with no expiration, with the INFINITE value.

BIGINT