Skip to content
AWS for Query.Farm

aws.logs.list_log_anomaly_detectors

Example SQL Queries

SELECT * FROM
aws.logs.list_log_anomaly_detectors;

Description

Retrieves a list of the log anomaly detectors in the account.

Table Definition

Column NameColumn Data Type
filter_log_group_arn Input Column

Use this to optionally filter the results to only include anomaly detectors that are associated with the specified log group.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
anomaly_detector_arn

The ARN of the anomaly detector.

VARCHAR
anomaly_detector_status

Specifies the current status of the anomaly detector. To pause an anomaly detector, use the enabled parameter in the UpdateLogAnomalyDetector operation.

VARCHAR
anomaly_visibility_time

The number of days used as the life cycle of anomalies. After this time, anomalies are automatically baselined and the anomaly detector model will treat new occurrences of similar event as normal. 

BIGINT
creation_time_stamp

The date and time when this anomaly detector was created.

BIGINT
detector_name

The name of the anomaly detector.

VARCHAR
evaluation_frequency

Specifies how often the anomaly detector runs and look for anomalies.

VARCHAR
filter_pattern

A symbolic description of how CloudWatch Logs should interpret the data in each log event. For example, a log event can contain timestamps, IP addresses, strings, and so on. You use the filter pattern to specify what to look for in the log event message.

VARCHAR
kms_key_id

The ID of the KMS key assigned to this anomaly detector, if any.

VARCHAR
last_modified_time_stamp

The date and time when this anomaly detector was most recently modified.

BIGINT
log_group_arn_list

A list of the ARNs of the log groups that this anomaly detector watches.

VARCHAR[]
Show child fields
log_group_arn_list[]