subscription_filters

Creates, updates, deletes or gets a subscription_filter resource or lists subscription_filters in a region

Overview

Name	subscription_filters
Type	Resource
Description	The AWS::Logs::SubscriptionFilter resource specifies a subscription filter and associates it with the specified log group. Subscription filters allow you to subscribe to a real-time stream of log events and have them delivered to a specific destination. Currently, the supported destinations are: + An Amazon Kinesis data stream belonging to the same account as the subscription filter, for same-account delivery. + A logical destination that belongs to a different account, for cross-account delivery. + An Amazon Kinesis Firehose delivery stream that belongs to the same account as the subscription filter, for same-account delivery. + An LAMlong function that belongs to the same account as the subscription filter, for same-account delivery. There can be as many as two subscription filters associated with a log group.
Id	awscc.logs.subscription_filters

Fields

get (all properties)

Name	Datatype	Description
filter_name	string	The name of the subscription filter.
destination_arn	string	The Amazon Resource Name (ARN) of the destination.
filter_pattern	string	The filtering expressions that restrict what gets delivered to the destination AWS resource. For more information about the filter pattern syntax, see Filter and Pattern Syntax.
log_group_name	string	The log group to associate with the subscription filter. All log events that are uploaded to this log group are filtered and delivered to the specified AWS resource if the filter pattern matches the log events.
role_arn	string	The ARN of an IAM role that grants CWL permissions to deliver ingested log events to the destination stream. You don't need to provide the ARN when you are working with a logical destination for cross-account delivery.
distribution	string	The method used to distribute log data to the destination, which can be either random or grouped by log stream.
apply_on_transformed_logs	boolean	This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see PutTransformer. If this value is true, the subscription filter is applied on the transformed version of the log events instead of the original ingested log events.
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
filter_name	string	The name of the subscription filter.
log_group_name	string	The log group to associate with the subscription filter. All log events that are uploaded to this log group are filtered and delivered to the specified AWS resource if the filter pattern matches the log events.
region	string	AWS region.

For more information, see AWS::Logs::SubscriptionFilter.

Methods

Name	Resource	Accessible by	Required Params
create_resource	subscription_filters	INSERT	DestinationArn, FilterPattern, LogGroupName, region
delete_resource	subscription_filters	DELETE	Identifier, region
update_resource	subscription_filters	UPDATE	Identifier, PatchDocument, region
list_resources	subscription_filters_list_only	SELECT	region
get_resource	subscription_filters	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual subscription_filter.

SELECT
  region,
  filter_name,
  destination_arn,
  filter_pattern,
  log_group_name,
  role_arn,
  distribution,
  apply_on_transformed_logs
FROM awscc.logs.subscription_filters
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ filter_name }}|{{ log_group_name }}';

list (identifiers only)

Lists all subscription_filters in a region.

SELECT
  region,
  filter_name,
  log_group_name
FROM awscc.logs.subscription_filters_list_only
WHERE
  region = '{{ region }}';

INSERT example

Use the following StackQL query and manifest file to create a new subscription_filter resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.logs.subscription_filters (
  DestinationArn,
  FilterPattern,
  LogGroupName,
  region
)
SELECT
  '{{ destination_arn }}',
  '{{ filter_pattern }}',
  '{{ log_group_name }}',
  '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

All Properties

/*+ create */
INSERT INTO awscc.logs.subscription_filters (
  FilterName,
  DestinationArn,
  FilterPattern,
  LogGroupName,
  RoleArn,
  Distribution,
  ApplyOnTransformedLogs,
  region
)
SELECT
  '{{ filter_name }}',
  '{{ destination_arn }}',
  '{{ filter_pattern }}',
  '{{ log_group_name }}',
  '{{ role_arn }}',
  '{{ distribution }}',
  '{{ apply_on_transformed_logs }}',
  '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

Manifest

version: 1
name: stack name
description: stack description
providers:
- aws
globals:
- name: region
  value: '{{ vars.AWS_REGION }}'
resources:
- name: subscription_filter
  props:
    - name: filter_name
      value: '{{ filter_name }}'
    - name: destination_arn
      value: '{{ destination_arn }}'
    - name: filter_pattern
      value: '{{ filter_pattern }}'
    - name: log_group_name
      value: '{{ log_group_name }}'
    - name: role_arn
      value: '{{ role_arn }}'
    - name: distribution
      value: '{{ distribution }}'
    - name: apply_on_transformed_logs
      value: '{{ apply_on_transformed_logs }}'

UPDATE example

Use the following StackQL query and manifest file to update a subscription_filter resource, using stack-deploy.

/*+ update */
UPDATE awscc.logs.subscription_filters
SET PatchDocument = string('{{ {
    "DestinationArn": destination_arn,
    "FilterPattern": filter_pattern,
    "RoleArn": role_arn,
    "Distribution": distribution,
    "ApplyOnTransformedLogs": apply_on_transformed_logs
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ filter_name }}|{{ log_group_name }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

DELETE example

/*+ delete */
DELETE FROM awscc.logs.subscription_filters
WHERE
  Identifier = '{{ filter_name }}|{{ log_group_name }}' AND
  region = '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

Additional Parameters

Mutable resources in the Cloud Control provider support additional optional parameters which can be supplied with INSERT, UPDATE, or DELETE operations. These include:

Parameter	Description
ClientToken	A unique identifier to ensure the idempotency of the resource request. This allows the provider to accurately distinguish between retries and new requests. A client token is valid for 36 hours once used. After that, a resource request with the same client token is treated as a new request. If you do not specify a client token, one is generated for inclusion in the request.
RoleArn	The ARN of the IAM role used to perform this resource operation. The role specified must have the permissions required for this operation. If you do not specify a role, a temporary session is created using your AWS user credentials.
TypeVersionId	For private resource types, the type version to use in this resource operation. If you do not specify a resource version, the default version is used.

Permissions

To operate on the subscription_filters resource, the following permissions are required:

Create

iam:PassRole,
logs:PutSubscriptionFilter,
logs:DescribeSubscriptionFilters

Read

logs:DescribeSubscriptionFilters

Update

iam:PassRole,
logs:PutSubscriptionFilter,
logs:DescribeSubscriptionFilters

Delete

logs:DeleteSubscriptionFilter

List

logs:DescribeSubscriptionFilters