website logo
HomeGithubSlack
⌘K
Overview
Quick Start
Supported Services
Running CloudGraph in EKS
Compliance
Rules Engine
AWS
Querying AWS Data
AWS Policy Packs
Billing Data
Services
Azure
Querying Azure Data
Azure Policy Packs
Services
GCP
Querying GCP Data
GCP Policy Packs
Services
K8s
Querying Kubernetes Data
Services
Docs powered by archbee 

Cloudwatch Log

16min

Note: if you are running CloudGraph locally you can view the interactive, automatically generated documentation in either GraphQL Playground or Altair by clicking the docs button on the right-hand side of the screen. After reading the below information we highly suggest you use one of these tools to test your queries as they will autocomplete fields for you and let you know if your queries are valid before you even submit them.

Overview

You can currently query the following attributes and connections on an AWS Cloudwatch Log

GraphQL
|
query {
  queryawsCloudwatchLog {
    id
    arn
    region
    creationTime
    retentionInDays
    metricFilterCount
    storedBytes
    kmsKeyId
    metricFilters {
      id
      filterName
      filterPattern
      creationTime
      logGroupName
      metricTransformations {
        metricName
        metricNamespace
        metricValue
        defaultValue
        unit
      }
    }
    cloudtrail {
      arn
      # Other fields and connections here...
    }
    cloudwatch {
      arn
      # Other fields and connections here...
    }
    kms {
      arn
      # Other fields and connections here...
    }
  }
}


Filtering

Get data for a single AWS Cloudwatch Log that you know the ARNfor:

GraphQL
|
query {
  getawsCloudwatchLog(arn: "arn:aws:ec2:us-east-1:111122223333:log-group:/aws/lambda/lambda-name:*") {
    arn
    # Other fields and connections here...
  }
}


Get data for all of the Cloudwatch Logs in a certain AWS account:

GraphQL
|
query {
  queryawsCloudwatchLog(filter: { accountId: { eq: "12345" } }) {
    arn
    # Other fields and connections here...
  }
}

# Note that in addition to "accountId" you can
# Filter based on any of the following attributes:

# id
# arn
# region
# creationTime
# retentionInDays
# metricFilterCount
# storedBytes
# kmsKeyId

# And the following Dgraph filters can also be applied:

# has
# and
# or
# not
# regexp (regular expressions)


Get data for all of the Cloudwatch Logs that are NOT in a certain AWS account:

GraphQL
|
query {
  queryawsCloudwatchLog(filter: { not: { accountId: { eq: "12345" } } }) {
    arn
    # Other fields and connections here...
  }
}


Advanced Filtering

Get data for all of the Cloudwatch Logs that have a connected cloudtrail:

GraphQL
|
query {
  queryawsCloudwatchLog(filter: { has: cloudtrail }) {
    arn
    # Other fields and connections here...
  }
}

# Note that in addition to "cloudtrail" you can filter
# Using "has" based on any of the following attributes:

# id
# arn
# region
# creationTime
# retentionInDays
# metricFilterCount
# storedBytes
# kmsKeyId
# metricFilters
# cloudwatch
# kms


Use multiple filter selectors, (i.e. has, and, not, or) to get data for all of the Cloudwatch Logs that have cloudtrail instances AND cloudwatch instances connected to them OR that do not have kms instances connected to them. Note that you can use has, and, not, or completely independently of each other:

GraphQL
|
query {
  queryawsCloudwatchLog(
    filter: {
      has: cloudtrail
      and: { has: cloudwatch }
      or: { not: { has: kms } }
    }
  ) {
    arn
    # Other fields and connections here...
  }
}


You may also filter using a regex when filtering on a string field like, region if you want to look for a value that matches say, us- to get all Cloudwatch Logs in us regions:

GraphQL
|
query {
  queryawsCloudwatchLog(filter: { region: { regexp: "/.*us-*/" } }) {
    arn
    # Other fields and connections here...
  }
}


Ordering

You can order the results you get back either asc or desc depending on your preference:

GraphQL
|
query {
  queryawsCloudwatchLog(order: { desc: region }) {
    arn
    # Other fields and connections here...
  }
}

# Note that in addition to "region" you can filter
# Using "asc" or "desc" based on any of the following attributes:

# id
# accountId
# arn
# creationTime
# retentionInDays
# metricFilterCount
# storedBytes
# kmsKeyId


Only select and return the first two Cloudwatch Logs that are found:

GraphQL
|
query {
  queryawsCloudwatchLog(first: 2, order: { desc: region }) {
    arn
    # Other fields and connections here...
  }
}


Only select and return the first two Cloudwatch Logs that are found, but offset by one so Cloudwatch Logs two & three are returned:

GraphQL
|
query {
  queryawsCloudwatchLog(first: 2, order: { desc: region }, offset: 1) {
    arn
    # Other fields and connections here...
  }
}


Aggregation

Count the number Cloudwatch Logs across all scanned AWS accounts:

GraphQL
|
query {
  aggregateawsCloudwatchLog {
    count
    # Other fields and connections here...
  }
}

# Note that in addition to "count" you can request the
# Following min and max values based on attributes of your Cloudwatch Logs:

# idMin
# idMax
# accountIdMin
# accountIdMax
# arnMin
# arnMax
# regionMin
# regionMax
# creationTimeMin
# creationTimeMax
# retentionInDaysMin
# retentionInDaysMax
# metricFilterCountMin
# metricFilterCountMax
# storedBytesMin
# storedBytesMax
# kmsKeyIdMin
# kmsKeyIdMax


Count the number of Cloudwatch Logs in a single account. Note that you can apply all of the same filters that are listed above to aggregate queries:

GraphQL
|
query {
  aggregateawsCloudwatchLog(filter: { accountId: { eq: "12345" } }) {
    count
    # Other fields and connections here...
  }
}


Examples

Find all of the Cloudwatch Logs that are in the us-east-1 region across all your accounts:

GraphQL
|
query {
  queryawsCloudwatchLog(filter: { region: { eq: "us-east-1" } }) {
    arn
    # Other fields and connections here...
  }
}


Kitchen Sink

Putting it all together; get all data for all Cloudwatch Logs across all regions for all scanned AWS accounts in a single query. For the purposes of this example we will only get direct children of the cloudwatch logs but if you want to it's easy to go from say, cloudwatchLogs -> cloudwatch-> sns ...etc:

GraphQL
|
query {
  queryawsCloudwatchLog {
    id
    arn
    region
    creationTime
    retentionInDays
    metricFilterCount
    storedBytes
    kmsKeyId
    metricFilters {
      id
      filterName
      filterPattern
      creationTime
      logGroupName
      metricTransformations {
        metricName
        metricNamespace
        metricValue
        defaultValue
        unit
      }
    }
    cloudtrail {
      id
      arn
      accountId
      cgId
      region
      name
      s3BucketName
      s3KeyPrefix
      includeGlobalServiceEvents
      isMultiRegionTrail
      homeRegion
      logFileValidationEnabled
      cloudWatchLogsLogGroupArn
      cloudWatchLogsRoleArn
      kmsKeyId
      hasInsightSelectors
      hasCustomEventSelectors
      isOrganizationTrail
      status {
        isLogging
        latestDeliveryTime
        latestNotificationTime
        startLoggingTime
        latestDigestDeliveryTime
        latestDeliveryAttemptTime
        latestNotificationAttemptTime
        latestDeliveryAttemptSucceeded
        latestCloudWatchLogsDeliveryTime
        timeLoggingStarted
        timeLoggingStopped
      }
      eventSelectors {
        id
        readWriteType
        includeManagementEvents
      }
      tags {
        id
        key
        value
      }
      s3 {
        arn
        # Other fields and connections here...
      }
      sns {
        arn
        # Other fields and connections here...
      }
      kms {
        arn
        # Other fields and connections here...
      }
      cloudwatchLog {
        arn
        # Other fields and connections here...
      }
    }
    cloudwatch {
      id
      accountId
      arn
      region
      metric
      namespace
      description
      actionsEnabled
      actions
      comparisonOperator
      statistic
      threshold
      period
      evaluationPeriods
      dimensions {
        id
        name
        value
      }
      tags {
        id
        key
        value
      }
      cloudwatchLog {
        arn
        # Other fields and connections here...
      }
      sns {
        arn
        # Other fields and connections here...
      } 
    }
    kms {
      id
      accountId
      arn
      region
      description
      keyRotationEnabled
      usage
      policy {
        id
        version
        statement {
          id
          action
          condition {
            id
            operator
            key
            value
          }
          effect
          principal{
            id
          }
          resource
        }
      }
      enabled
      keyState
      customerMasterKeySpec
      creationDate
      keyManager
      origin
      deletionDate
      validTo
      tags {
        id
        key
        value
      }
      lambda {
        arn
        # Other fields and connections here...
      }
      cloudtrail {
        arn
        # Other fields and connections here...
      }
      redshiftCluster {
        arn
        # Other fields and connections here...
      }
      sns {
        arn
        # Other fields and connections here...
      }
      eksCluster {
        arn
        # Other fields and connections here...
      }
    }
  }
}


References

Dgraph documentation on querying

AWS Cloudwatch Log documentation

Updated 03 Mar 2023
Did this page help you?
Yes
No
PREVIOUS
Client VPN Endpoint
NEXT
Configuration Recorder
Docs powered by archbee 
TABLE OF CONTENTS
Overview
Filtering
Advanced Filtering
Ordering
Aggregation
Examples
Kitchen Sink
References