public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CloudWatch: Add anomaly command to language support, add documentation for anomaly queries (#113311)

Browse Source
This commit is contained in:
Ida Štambuk
2025-11-07 09:54:24 +00:00
committed by GitHub
parent 488423abfc
commit 942b847952
8 changed files with 30 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/datasources/aws-cloudwatch/query-editor/index.md
+14 -1
View File
@@ -250,6 +250,19 @@ You can query CloudWatch Logs using three supported query language options:
1. Select a region.
1. Select **CloudWatch Logs** from the query type drop-down.
1. Select the Logs Mode depending on whether you would like to query CloudWatch Logs Insights or Log Anomalies
**Log Anomalies**
[Anomaly detection](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection.html) uses machine-learning and pattern recognition to establish baselines of typical log content.
The Log Anomalies query editor fetches the list of anomalies detected in your CloudWatch service. In order to query log anomalies in the editor, a log anomaly detector must be created in the AWS CloudWatch console first.
The log trend cell shows the number of occurrences of the pattern over the selected query time range.
The table shows 50 log anomalies at a time. If you would like to narrow down the list, you can filter anomalies by their ARN and suppressed state.
In addition to this, you can use the Logs Insights QL editor and the `anomaly` command together with the `patterns` command to define and display log anomalies in real time. See the [CloudWatch Logs Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection-Insights.html) documentation for more info.
**Logs Insights**
1. Select the query language you would like to use in the **Query Language** drop-down.
1. Click **Select log groups** and choose up to 20 log groups to query.
1. Use the main input area to write your logs query. Amazon CloudWatch only supports a subset of OpenSearch SQL and PPL commands. To find out more about the syntax supported, consult [Amazon CloudWatch Logs documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_Languages.html)
@@ -258,7 +271,7 @@ You can query CloudWatch Logs using three supported query language options:
You must specify the region and log groups when querying with **Logs Insights QL** and **OpenSearch PPL**. **OpenSearch SQL** doesn't require log group selection. However, selecting log groups simplifies query writing by populating syntax suggestions with discovered log group fields.
{{< /admonition >}}
Click **CloudWatch Logs Insights** to interactively view, search, and analyze your log data in the CloudWatch Logs Insights console. If you're not logged in to the CloudWatch console, the link forwards you to the login page.
Click **View in CloudWatch console** to interactively view, search, and analyze your log data in the CloudWatch Logs Insights console. If you're not logged in to the CloudWatch console, the link forwards you to the login page.
### Query Log groups with OpenSearch SQL
packages/grafana-schema/src/raw/composable/cloudwatch/dataquery/x/CloudWatchDataQuery_types.gen.ts
Generated
+3 -3
View File
@@ -247,7 +247,7 @@ export interface CloudWatchLogsQuery extends common.DataQuery {
*/
logGroups?: Array<LogGroup>;
/**
* Whether a query is a Logs Insights or Logs Anomalies query
* Whether a query is a Logs Insights or Log Anomalies query
*/
logsMode?: LogsMode;
/**
@@ -275,7 +275,7 @@ export const defaultCloudWatchLogsQuery: Partial<CloudWatchLogsQuery> = {
};
/**
* Shape of a Cloudwatch Logs Anomalies query
* Shape of a Cloudwatch Log Anomalies query
*/
export interface CloudWatchLogsAnomaliesQuery extends common.DataQuery {
/**
@@ -284,7 +284,7 @@ export interface CloudWatchLogsAnomaliesQuery extends common.DataQuery {
anomalyDetectionARN?: string;
id: string;
/**
* Whether a query is a Logs Insights or Logs Anomalies query
* Whether a query is a Logs Insights or Log Anomalies query
*/
logsMode?: LogsMode;
/**
pkg/tsdb/cloudwatch/kinds/dataquery/types_dataquery_gen.go
Generated
+3 -3
View File
@@ -304,7 +304,7 @@ const (
type CloudWatchLogsQuery struct {
// Whether a query is a Metrics, Logs, or Annotations query
QueryMode CloudWatchQueryMode `json:"queryMode"`
// Whether a query is a Logs Insights or Logs Anomalies query
// Whether a query is a Logs Insights or Log Anomalies query
LogsMode *LogsMode `json:"logsMode,omitempty"`
Id string `json:"id"`
// AWS region to query for the logs
@@ -356,14 +356,14 @@ func NewLogGroup() *LogGroup {
return &LogGroup{}
}
// Shape of a Cloudwatch Logs Anomalies query
// Shape of a Cloudwatch Log Anomalies query
type CloudWatchLogsAnomaliesQuery struct {
Id string `json:"id"`
// AWS region to query for the logs
Region string `json:"region"`
// Whether a query is a Metrics, Logs or Annotations query
QueryMode *CloudWatchQueryMode `json:"queryMode,omitempty"`
// Whether a query is a Logs Insights or Logs Anomalies query
// Whether a query is a Logs Insights or Log Anomalies query
LogsMode *LogsMode `json:"logsMode,omitempty"`
// Filter to return only anomalies that are 'SUPPRESSED', 'UNSUPPRESSED', or 'ALL' (default)
SuppressionState *string `json:"suppressionState,omitempty"`
public/app/plugins/datasource/cloudwatch/components/QueryEditor/LogsQueryEditor/LogsQueryEditor.tsx
+1 -1
View File
@@ -25,7 +25,7 @@ const logsQueryLanguageOptions: Array<SelectableValue<LogsQueryLanguage>> = [
const logsModeOptions: Array<SelectableValue<LogsMode>> = [
{ label: 'Logs Insights', value: LogsMode.Insights },
{ label: 'Logs Anomalies', value: LogsMode.Anomalies },
{ label: 'Log Anomalies', value: LogsMode.Anomalies },
];
export const CloudWatchLogsQueryEditor = memo(function CloudWatchLogsQueryEditor(props: Props) {
public/app/plugins/datasource/cloudwatch/dataquery.cue
+3 -3
View File
@@ -155,7 +155,7 @@ composableKinds: DataQuery: {
// Whether a query is a Metrics, Logs, or Annotations query
queryMode: #CloudWatchQueryMode
// Whether a query is a Logs Insights or Logs Anomalies query
// Whether a query is a Logs Insights or Log Anomalies query
logsMode?: #LogsMode
id: string
// AWS region to query for the logs
@@ -173,7 +173,7 @@ composableKinds: DataQuery: {
queryLanguage?: #LogsQueryLanguage
} @cuetsy(kind="interface")
// Shape of a Cloudwatch Logs Anomalies query
// Shape of a Cloudwatch Log Anomalies query
#CloudWatchLogsAnomaliesQuery: {
common.DataQuery
id: string
@@ -181,7 +181,7 @@ composableKinds: DataQuery: {
region: string
// Whether a query is a Metrics, Logs or Annotations query
queryMode?: #CloudWatchQueryMode
// Whether a query is a Logs Insights or Logs Anomalies query
// Whether a query is a Logs Insights or Log Anomalies query
logsMode?: #LogsMode
// Filter to return only anomalies that are 'SUPPRESSED', 'UNSUPPRESSED', or 'ALL' (default)
suppressionState?: string
public/app/plugins/datasource/cloudwatch/dataquery.gen.ts
Generated
+3 -3
View File
@@ -245,7 +245,7 @@ export interface CloudWatchLogsQuery extends common.DataQuery {
*/
logGroups?: Array<LogGroup>;
/**
* Whether a query is a Logs Insights or Logs Anomalies query
* Whether a query is a Logs Insights or Log Anomalies query
*/
logsMode?: LogsMode;
/**
@@ -273,7 +273,7 @@ export const defaultCloudWatchLogsQuery: Partial<CloudWatchLogsQuery> = {
};
/**
* Shape of a Cloudwatch Logs Anomalies query
* Shape of a Cloudwatch Log Anomalies query
*/
export interface CloudWatchLogsAnomaliesQuery extends common.DataQuery {
/**
@@ -282,7 +282,7 @@ export interface CloudWatchLogsAnomaliesQuery extends common.DataQuery {
anomalyDetectionARN?: string;
id: string;
/**
* Whether a query is a Logs Insights or Logs Anomalies query
* Whether a query is a Logs Insights or Log Anomalies query
*/
logsMode?: LogsMode;
/**
public/app/plugins/datasource/cloudwatch/language/logs/language.ts
+2 -1
View File
@@ -17,7 +17,8 @@ export const SORT = 'sort';
export const LIMIT = 'limit';
export const PARSE = 'parse';
export const DEDUP = 'dedup';
export const LOGS_COMMANDS = [DISPLAY, FIELDS, FILTER, PATTERN, STATS, SORT, LIMIT, PARSE, DEDUP, DIFF];
export const ANOMALY = 'anomaly';
export const LOGS_COMMANDS = [DISPLAY, FIELDS, FILTER, PATTERN, STATS, SORT, LIMIT, PARSE, DEDUP, DIFF, ANOMALY];
export const LOGS_LOGIC_OPERATORS = ['and', 'or', 'not'];
public/app/plugins/datasource/cloudwatch/query-runner/CloudWatchLogsQueryRunner.test.ts
+1 -1
View File
@@ -823,7 +823,7 @@ const stopQueryResponseStub = {
const anomaliesQueryResponse: DataQueryResponse = {
data: [
{
name: 'Logs anomalies',
name: 'Log anomalies',
refId: 'A',
meta: {
preferredVisualisationType: 'table',