From 942b847952d0a8b5cb6cd89235cc7afb0f8206d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ida=20=C5=A0tambuk?= Date: Fri, 7 Nov 2025 10:54:24 +0100 Subject: [PATCH] CloudWatch: Add anomaly command to language support, add documentation for anomaly queries (#113311) --- .../aws-cloudwatch/query-editor/index.md | 15 ++++++++++++++- .../dataquery/x/CloudWatchDataQuery_types.gen.ts | 6 +++--- .../kinds/dataquery/types_dataquery_gen.go | 6 +++--- .../LogsQueryEditor/LogsQueryEditor.tsx | 2 +- .../plugins/datasource/cloudwatch/dataquery.cue | 6 +++--- .../datasource/cloudwatch/dataquery.gen.ts | 6 +++--- .../cloudwatch/language/logs/language.ts | 3 ++- .../CloudWatchLogsQueryRunner.test.ts | 2 +- 8 files changed, 30 insertions(+), 16 deletions(-) diff --git a/docs/sources/datasources/aws-cloudwatch/query-editor/index.md b/docs/sources/datasources/aws-cloudwatch/query-editor/index.md index 02b229e50f9..9bc7ab64047 100644 --- a/docs/sources/datasources/aws-cloudwatch/query-editor/index.md +++ b/docs/sources/datasources/aws-cloudwatch/query-editor/index.md @@ -250,6 +250,19 @@ You can query CloudWatch Logs using three supported query language options: 1. Select a region. 1. Select **CloudWatch Logs** from the query type drop-down. +1. Select the Logs Mode depending on whether you would like to query CloudWatch Logs Insights or Log Anomalies + +**Log Anomalies** + +[Anomaly detection](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection.html) uses machine-learning and pattern recognition to establish baselines of typical log content. +The Log Anomalies query editor fetches the list of anomalies detected in your CloudWatch service. In order to query log anomalies in the editor, a log anomaly detector must be created in the AWS CloudWatch console first. +The log trend cell shows the number of occurrences of the pattern over the selected query time range. +The table shows 50 log anomalies at a time. If you would like to narrow down the list, you can filter anomalies by their ARN and suppressed state. + +In addition to this, you can use the Logs Insights QL editor and the `anomaly` command together with the `patterns` command to define and display log anomalies in real time. See the [CloudWatch Logs Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection-Insights.html) documentation for more info. + +**Logs Insights** + 1. Select the query language you would like to use in the **Query Language** drop-down. 1. Click **Select log groups** and choose up to 20 log groups to query. 1. Use the main input area to write your logs query. Amazon CloudWatch only supports a subset of OpenSearch SQL and PPL commands. To find out more about the syntax supported, consult [Amazon CloudWatch Logs documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_Languages.html) @@ -258,7 +271,7 @@ You can query CloudWatch Logs using three supported query language options: You must specify the region and log groups when querying with **Logs Insights QL** and **OpenSearch PPL**. **OpenSearch SQL** doesn't require log group selection. However, selecting log groups simplifies query writing by populating syntax suggestions with discovered log group fields. {{< /admonition >}} -Click **CloudWatch Logs Insights** to interactively view, search, and analyze your log data in the CloudWatch Logs Insights console. If you're not logged in to the CloudWatch console, the link forwards you to the login page. +Click **View in CloudWatch console** to interactively view, search, and analyze your log data in the CloudWatch Logs Insights console. If you're not logged in to the CloudWatch console, the link forwards you to the login page. ### Query Log groups with OpenSearch SQL diff --git a/packages/grafana-schema/src/raw/composable/cloudwatch/dataquery/x/CloudWatchDataQuery_types.gen.ts b/packages/grafana-schema/src/raw/composable/cloudwatch/dataquery/x/CloudWatchDataQuery_types.gen.ts index 7f197b13d18..eb0dd667076 100644 --- a/packages/grafana-schema/src/raw/composable/cloudwatch/dataquery/x/CloudWatchDataQuery_types.gen.ts +++ b/packages/grafana-schema/src/raw/composable/cloudwatch/dataquery/x/CloudWatchDataQuery_types.gen.ts @@ -247,7 +247,7 @@ export interface CloudWatchLogsQuery extends common.DataQuery { */ logGroups?: Array; /** - * Whether a query is a Logs Insights or Logs Anomalies query + * Whether a query is a Logs Insights or Log Anomalies query */ logsMode?: LogsMode; /** @@ -275,7 +275,7 @@ export const defaultCloudWatchLogsQuery: Partial = { }; /** - * Shape of a Cloudwatch Logs Anomalies query + * Shape of a Cloudwatch Log Anomalies query */ export interface CloudWatchLogsAnomaliesQuery extends common.DataQuery { /** @@ -284,7 +284,7 @@ export interface CloudWatchLogsAnomaliesQuery extends common.DataQuery { anomalyDetectionARN?: string; id: string; /** - * Whether a query is a Logs Insights or Logs Anomalies query + * Whether a query is a Logs Insights or Log Anomalies query */ logsMode?: LogsMode; /** diff --git a/pkg/tsdb/cloudwatch/kinds/dataquery/types_dataquery_gen.go b/pkg/tsdb/cloudwatch/kinds/dataquery/types_dataquery_gen.go index ce8bc54c6c5..7d943a71130 100644 --- a/pkg/tsdb/cloudwatch/kinds/dataquery/types_dataquery_gen.go +++ b/pkg/tsdb/cloudwatch/kinds/dataquery/types_dataquery_gen.go @@ -304,7 +304,7 @@ const ( type CloudWatchLogsQuery struct { // Whether a query is a Metrics, Logs, or Annotations query QueryMode CloudWatchQueryMode `json:"queryMode"` - // Whether a query is a Logs Insights or Logs Anomalies query + // Whether a query is a Logs Insights or Log Anomalies query LogsMode *LogsMode `json:"logsMode,omitempty"` Id string `json:"id"` // AWS region to query for the logs @@ -356,14 +356,14 @@ func NewLogGroup() *LogGroup { return &LogGroup{} } -// Shape of a Cloudwatch Logs Anomalies query +// Shape of a Cloudwatch Log Anomalies query type CloudWatchLogsAnomaliesQuery struct { Id string `json:"id"` // AWS region to query for the logs Region string `json:"region"` // Whether a query is a Metrics, Logs or Annotations query QueryMode *CloudWatchQueryMode `json:"queryMode,omitempty"` - // Whether a query is a Logs Insights or Logs Anomalies query + // Whether a query is a Logs Insights or Log Anomalies query LogsMode *LogsMode `json:"logsMode,omitempty"` // Filter to return only anomalies that are 'SUPPRESSED', 'UNSUPPRESSED', or 'ALL' (default) SuppressionState *string `json:"suppressionState,omitempty"` diff --git a/public/app/plugins/datasource/cloudwatch/components/QueryEditor/LogsQueryEditor/LogsQueryEditor.tsx b/public/app/plugins/datasource/cloudwatch/components/QueryEditor/LogsQueryEditor/LogsQueryEditor.tsx index bf59c959066..b0659d7abe7 100644 --- a/public/app/plugins/datasource/cloudwatch/components/QueryEditor/LogsQueryEditor/LogsQueryEditor.tsx +++ b/public/app/plugins/datasource/cloudwatch/components/QueryEditor/LogsQueryEditor/LogsQueryEditor.tsx @@ -25,7 +25,7 @@ const logsQueryLanguageOptions: Array> = [ const logsModeOptions: Array> = [ { label: 'Logs Insights', value: LogsMode.Insights }, - { label: 'Logs Anomalies', value: LogsMode.Anomalies }, + { label: 'Log Anomalies', value: LogsMode.Anomalies }, ]; export const CloudWatchLogsQueryEditor = memo(function CloudWatchLogsQueryEditor(props: Props) { diff --git a/public/app/plugins/datasource/cloudwatch/dataquery.cue b/public/app/plugins/datasource/cloudwatch/dataquery.cue index 4144b423419..836d59c8f60 100644 --- a/public/app/plugins/datasource/cloudwatch/dataquery.cue +++ b/public/app/plugins/datasource/cloudwatch/dataquery.cue @@ -155,7 +155,7 @@ composableKinds: DataQuery: { // Whether a query is a Metrics, Logs, or Annotations query queryMode: #CloudWatchQueryMode - // Whether a query is a Logs Insights or Logs Anomalies query + // Whether a query is a Logs Insights or Log Anomalies query logsMode?: #LogsMode id: string // AWS region to query for the logs @@ -173,7 +173,7 @@ composableKinds: DataQuery: { queryLanguage?: #LogsQueryLanguage } @cuetsy(kind="interface") - // Shape of a Cloudwatch Logs Anomalies query + // Shape of a Cloudwatch Log Anomalies query #CloudWatchLogsAnomaliesQuery: { common.DataQuery id: string @@ -181,7 +181,7 @@ composableKinds: DataQuery: { region: string // Whether a query is a Metrics, Logs or Annotations query queryMode?: #CloudWatchQueryMode - // Whether a query is a Logs Insights or Logs Anomalies query + // Whether a query is a Logs Insights or Log Anomalies query logsMode?: #LogsMode // Filter to return only anomalies that are 'SUPPRESSED', 'UNSUPPRESSED', or 'ALL' (default) suppressionState?: string diff --git a/public/app/plugins/datasource/cloudwatch/dataquery.gen.ts b/public/app/plugins/datasource/cloudwatch/dataquery.gen.ts index ba0a1134d2d..28818f2f1ab 100644 --- a/public/app/plugins/datasource/cloudwatch/dataquery.gen.ts +++ b/public/app/plugins/datasource/cloudwatch/dataquery.gen.ts @@ -245,7 +245,7 @@ export interface CloudWatchLogsQuery extends common.DataQuery { */ logGroups?: Array; /** - * Whether a query is a Logs Insights or Logs Anomalies query + * Whether a query is a Logs Insights or Log Anomalies query */ logsMode?: LogsMode; /** @@ -273,7 +273,7 @@ export const defaultCloudWatchLogsQuery: Partial = { }; /** - * Shape of a Cloudwatch Logs Anomalies query + * Shape of a Cloudwatch Log Anomalies query */ export interface CloudWatchLogsAnomaliesQuery extends common.DataQuery { /** @@ -282,7 +282,7 @@ export interface CloudWatchLogsAnomaliesQuery extends common.DataQuery { anomalyDetectionARN?: string; id: string; /** - * Whether a query is a Logs Insights or Logs Anomalies query + * Whether a query is a Logs Insights or Log Anomalies query */ logsMode?: LogsMode; /** diff --git a/public/app/plugins/datasource/cloudwatch/language/logs/language.ts b/public/app/plugins/datasource/cloudwatch/language/logs/language.ts index f70d844aaf7..f49af73e2f3 100644 --- a/public/app/plugins/datasource/cloudwatch/language/logs/language.ts +++ b/public/app/plugins/datasource/cloudwatch/language/logs/language.ts @@ -17,7 +17,8 @@ export const SORT = 'sort'; export const LIMIT = 'limit'; export const PARSE = 'parse'; export const DEDUP = 'dedup'; -export const LOGS_COMMANDS = [DISPLAY, FIELDS, FILTER, PATTERN, STATS, SORT, LIMIT, PARSE, DEDUP, DIFF]; +export const ANOMALY = 'anomaly'; +export const LOGS_COMMANDS = [DISPLAY, FIELDS, FILTER, PATTERN, STATS, SORT, LIMIT, PARSE, DEDUP, DIFF, ANOMALY]; export const LOGS_LOGIC_OPERATORS = ['and', 'or', 'not']; diff --git a/public/app/plugins/datasource/cloudwatch/query-runner/CloudWatchLogsQueryRunner.test.ts b/public/app/plugins/datasource/cloudwatch/query-runner/CloudWatchLogsQueryRunner.test.ts index 55d411585a3..8eee779cdcf 100644 --- a/public/app/plugins/datasource/cloudwatch/query-runner/CloudWatchLogsQueryRunner.test.ts +++ b/public/app/plugins/datasource/cloudwatch/query-runner/CloudWatchLogsQueryRunner.test.ts @@ -823,7 +823,7 @@ const stopQueryResponseStub = { const anomaliesQueryResponse: DataQueryResponse = { data: [ { - name: 'Logs anomalies', + name: 'Log anomalies', refId: 'A', meta: { preferredVisualisationType: 'table',