subscription_filters

Creates, updates, deletes or gets a subscription_filter resource or lists subscription_filters in a region

Overview

Name	subscription_filters
Type	Resource
Description	The ``AWS::Logs::SubscriptionFilter`` resource specifies a subscription filter and associates it with the specified log group. Subscription filters allow you to subscribe to a real-time stream of log events and have them delivered to a specific destination. Currently, the supported destinations are: + An Amazon Kinesis data stream belonging to the same account as the subscription filter, for same-account delivery. + A logical destination that belongs to a different account, for cross-account delivery. + An Amazon Kinesis Firehose delivery stream that belongs to the same account as the subscription filter, for same-account delivery. + An LAMlong function that belongs to the same account as the subscription filter, for same-account delivery. There can be as many as two subscription filters associated with a log group.
Id	awscc.logs.subscription_filters

Fields

get (all properties)

Name	Datatype	Description
filter_name	string	The name of the subscription filter.
destination_arn	string	The Amazon Resource Name (ARN) of the destination.
filter_pattern	string	The filtering expressions that restrict what gets delivered to the destination AWS resource. For more information about the filter pattern syntax, see [Filter and Pattern Syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html).
log_group_name	string	The log group to associate with the subscription filter. All log events that are uploaded to this log group are filtered and delivered to the specified AWS resource if the filter pattern matches the log events.
role_arn	string	The ARN of an IAM role that grants CWL permissions to deliver ingested log events to the destination stream. You don't need to provide the ARN when you are working with a logical destination for cross-account delivery.
distribution	string	The method used to distribute log data to the destination, which can be either random or grouped by log stream.
apply_on_transformed_logs	boolean	This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see &#91;PutTransformer&#93;(https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API&#95;PutTransformer.html).<br />If this value is &#96;&#96;true&#96;&#96;, the subscription filter is applied on the transformed version of the log events instead of the original ingested log events.
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
filter_name	string	The name of the subscription filter.
log_group_name	string	The log group to associate with the subscription filter. All log events that are uploaded to this log group are filtered and delivered to the specified AWS resource if the filter pattern matches the log events.
region	string	AWS region.

For more information, see AWS::Logs::SubscriptionFilter.

Methods

Name	Resource	Accessible by	Required Params
create_resource	subscription_filters	INSERT	DestinationArn, FilterPattern, LogGroupName, region
delete_resource	subscription_filters	DELETE	Identifier, region
update_resource	subscription_filters	UPDATE	Identifier, PatchDocument, region
list_resources	subscription_filters_list_only	SELECT	region
get_resource	subscription_filters	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual subscription_filter.

SELECT
  region,
  filter_name,
  destination_arn,
  filter_pattern,
  log_group_name,
  role_arn,
  distribution,
  apply_on_transformed_logs
FROM awscc.logs.subscription_filters
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ filter_name }}|{{ log_group_name }}';

list (identifiers only)

Lists all subscription_filters in a region.

SELECT
  region,
  filter_name,
  log_group_name
FROM awscc.logs.subscription_filters_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new subscription_filter resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.logs.subscription_filters (
  DestinationArn,
  FilterPattern,
  LogGroupName,
  region
)
SELECT
  '{{ destination_arn }}',
  '{{ filter_pattern }}',
  '{{ log_group_name }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.logs.subscription_filters (
  FilterName,
  DestinationArn,
  FilterPattern,
  LogGroupName,
  RoleArn,
  Distribution,
  ApplyOnTransformedLogs,
  region
)
SELECT
  '{{ filter_name }}',
  '{{ destination_arn }}',
  '{{ filter_pattern }}',
  '{{ log_group_name }}',
  '{{ role_arn }}',
  '{{ distribution }}',
  '{{ apply_on_transformed_logs }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: subscription_filter
    props:
      - name: filter_name
        value: '{{ filter_name }}'
      - name: destination_arn
        value: '{{ destination_arn }}'
      - name: filter_pattern
        value: '{{ filter_pattern }}'
      - name: log_group_name
        value: '{{ log_group_name }}'
      - name: role_arn
        value: '{{ role_arn }}'
      - name: distribution
        value: '{{ distribution }}'
      - name: apply_on_transformed_logs
        value: '{{ apply_on_transformed_logs }}'

UPDATE example

Use the following StackQL query and manifest file to update a subscription_filter resource, using stack-deploy.

/*+ update */
UPDATE awscc.logs.subscription_filters
SET PatchDocument = string('{{ {
    "DestinationArn": destination_arn,
    "FilterPattern": filter_pattern,
    "RoleArn": role_arn,
    "Distribution": distribution,
    "ApplyOnTransformedLogs": apply_on_transformed_logs
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ filter_name }}|{{ log_group_name }}';

DELETE example

/*+ delete */
DELETE FROM awscc.logs.subscription_filters
WHERE
  Identifier = '{{ filter_name }}|{{ log_group_name }}' AND
  region = 'us-east-1';

Permissions

To operate on the subscription_filters resource, the following permissions are required:

Create

iam:PassRole,
logs:PutSubscriptionFilter,
logs:DescribeSubscriptionFilters

Read

logs:DescribeSubscriptionFilters

Update

iam:PassRole,
logs:PutSubscriptionFilter,
logs:DescribeSubscriptionFilters

Delete

logs:DeleteSubscriptionFilter

List

logs:DescribeSubscriptionFilters