cloudwatchlogs

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 20, 2026 License: MIT Imports: 33 Imported by: 0

README

CloudWatch Logs

Parity grade: A · SDK aws-sdk-go-v2/service/cloudwatchlogs@v1.64.0 · last audited 2026-07-11 (3884816a)

Coverage

Metric Value
Operations audited 24 (24 ok)
Feature families 1 (1 ok)
Known gaps 3
Deferred items 3
Resource leaks clean
Known gaps
  • MetricTransformation.Dimensions is accepted, validated on the wire, and persisted on the MetricFilter, but is never forwarded to the emitted CloudWatch metric: the MetricEmitter interface (backend.go) only carries namespace/name/value/unit, and its real implementation is wired in cli.go's wireCWLogsMetricEmitter, which is out of scope for this pass (SHARED FILE). Extending the interface + cli.go wiring to carry dimensions is a real fix but requires touching cli.go. (bd: gopherstack-b14)
  • GetLogGroupFields always returns the 4 static built-in fields (@message/@timestamp/@ingestionTime/@logStream) and never samples real ingested log content, so it cannot discover custom JSON/space-pattern fields the way real AWS does (percent-of-sampled-events containing each discovered key). Not fixed this pass (a genuine sampling+percentage feature, lower priority than the PutLogEvents/metric-filter fixes actually made). (bd: gopherstack-b14)
  • PutLogEvents does not enforce two documented batch-shape constraints: (1) events in a single request must be in strict chronological order or the whole call should fail; (2) the valid-event timestamp span within one batch cannot exceed 24 hours. Both are documented in the current SDK's PutLogEvents doc comment. Not implemented this pass: doing so safely requires auditing whether existing out-of-order-friendly tests/call sites (this codebase's own appendEvents doc explicitly says "log events may arrive with out-of-order timestamps" ) depend on the current relaxed behavior; higher risk/effort than the fixes made, so deferred rather than rushed. (bd: gopherstack-b14)
Deferred
  • Insights query language/stages/parser correctness (insights_expr.go, insights_parse.go, insights_parser.go, insights_stages.go, insights_stats.go) -- not re-verified op-by-op against CloudWatch Logs Insights query syntax this pass.
  • Export/Import task lifecycle edge cases, Deliveries, Log Anomaly Detectors, Scheduled Queries, Account Policies, Data Protection/Resource/Index Policies, Transformers, Integrations (handler_completeness.go / backend_completeness.go, ~2100 LOC) -- spot-checked only, not exhaustively audited op-by-op.
  • StartLiveTail streaming transport (intentionally out of scope; validation-only by design).

More

Documentation

Index

Constants

View Source 
const (
	LogGroupClassStandard         = "STANDARD"
	LogGroupClassInfrequentAccess = "INFREQUENT_ACCESS"
)

LogGroupClass constants match the AWS CloudWatch Logs API enum.

View Source 
const (
	DistributionRandom      = "Random"
	DistributionByLogStream = "ByLogStream"
)

Distribution constants for subscription filter event routing.

Variables

View Source 
var (
	ErrLogGroupNotFound              = errors.New("ResourceNotFoundException")
	ErrLogGroupAlreadyExists         = errors.New("ResourceAlreadyExistsException")
	ErrLogStreamNotFound             = errors.New("ResourceNotFoundException")
	ErrLogStreamAlreadyExist         = errors.New("ResourceAlreadyExistsException")
	ErrSubscriptionFilterNotFound    = errors.New("ResourceNotFoundException")
	ErrSubscriptionFilterLimitExceed = errors.New("LimitExceededException")
	ErrQueryNotFound                 = errors.New("ResourceNotFoundException")
	ErrExportTaskNotFound            = errors.New("ResourceNotFoundException")
	ErrImportTaskNotFound            = errors.New("ResourceNotFoundException")
	ErrValidation                    = errors.New("InvalidParameterException")
	ErrDeliveryNotFound              = errors.New("ResourceNotFoundException")
	ErrLogAnomalyDetectorNotFound    = errors.New("ResourceNotFoundException")
	ErrScheduledQueryNotFound        = errors.New("ResourceNotFoundException")
	ErrMetricFilterNotFound          = errors.New("ResourceNotFoundException")
	ErrQueryDefinitionNotFound       = errors.New("ResourceNotFoundException")
	ErrOperationAborted              = errors.New("OperationAbortedException")
	ErrInvalidOperation              = errors.New("InvalidOperationException")
)
View Source 
var (
	ErrResourcePolicyNotFound      = errors.New("ResourceNotFoundException")
	ErrDeliveryDestinationNotFound = errors.New("ResourceNotFoundException")
	ErrDeliverySourceNotFound      = errors.New("ResourceNotFoundException")
	ErrDestinationNotFound         = errors.New("ResourceNotFoundException")
	ErrIndexPolicyNotFound         = errors.New("ResourceNotFoundException")
	ErrTransformerNotFound         = errors.New("ResourceNotFoundException")
	ErrIntegrationNotFound         = errors.New("ResourceNotFoundException")
)
View Source 
var ErrNilAppContext = errors.New("AppContext is required")

ErrNilAppContext is returned when Provider.Init is called with a nil AppContext.

View Source 
var ErrParseExpr = errors.New("parse expression")

ErrParseExpr indicates a malformed Insights expression.

Functions

This section is empty.

Types

type AccountPolicy 

type AccountPolicy struct {
	PolicyName        string `json:"policyName"`
	PolicyType        string `json:"policyType"`
	PolicyDocument    string `json:"policyDocument,omitempty"`
	Scope             string `json:"scope,omitempty"`
	SelectionCriteria string `json:"selectionCriteria,omitempty"`
}

AccountPolicy represents a CloudWatch Logs account-level policy.

type AggregateLogGroupSummary 

type AggregateLogGroupSummary struct {
	LogGroupName  string `json:"logGroupName"`
	LogGroupArn   string `json:"logGroupArn"`
	LogGroupClass string `json:"logGroupClass,omitempty"`
	StoredBytes   int64  `json:"storedBytes"`
	LogEventCount int64  `json:"logEventCount"`
}

AggregateLogGroupSummary describes aggregated statistics for a single log group.

type Anomaly 

type Anomaly struct {
	AnomalyDetectorArn string `json:"anomalyDetectorArn"`
	AnomalyID          string `json:"anomalyId"`
	Description        string `json:"description"`
	SuppressedState    string `json:"suppressedState,omitempty"`
	FirstSeen          int64  `json:"firstSeen"`
	LastSeen           int64  `json:"lastSeen"`
	SuppressedDate     int64  `json:"suppressedDate,omitempty"`
	Active             bool   `json:"active"`
}

Anomaly represents a detected log anomaly.

type CWLDestination 

type CWLDestination struct {
	CreatedAt       time.Time `json:"-"`
	DestinationName string    `json:"destinationName"`
	TargetArn       string    `json:"targetArn"`
	RoleArn         string    `json:"roleArn"`
	AccessPolicy    string    `json:"accessPolicy,omitempty"`
	Arn             string    `json:"arn"`
}

CWLDestination represents a CloudWatch Logs log routing destination.

type CWLIntegration 

type CWLIntegration struct {
	CreatedAt time.Time `json:"-"`
	Name      string    `json:"integrationName"`
	Type      string    `json:"integrationType"`
	Status    string    `json:"integrationStatus"`
}

CWLIntegration represents a CloudWatch Logs integration (e.g. OpenSearch).

type ConfigProvider 

type ConfigProvider interface {
	GetCloudWatchLogsSettings() Settings
}

ConfigProvider is a private interface to extract CloudWatch Logs configuration from the abstract AppContext Config.

type Delivery 

type Delivery struct {
	Tags                   map[string]string `json:"tags,omitempty"`
	ID                     string            `json:"id"`
	Arn                    string            `json:"arn"`
	DeliverySourceName     string            `json:"deliverySourceName"`
	DeliveryDestinationArn string            `json:"deliveryDestinationArn"`
	FieldDelimiter         string            `json:"fieldDelimiter,omitempty"`
	RecordFields           []string          `json:"recordFields,omitempty"`
	CreationTime           int64             `json:"creationTime"`
}

Delivery represents a CloudWatch Logs delivery configuration.

type DeliveryDestination 

type DeliveryDestination struct {
	CreatedAt    time.Time         `json:"-"`
	Tags         map[string]string `json:"tags,omitempty"`
	Name         string            `json:"name"`
	Arn          string            `json:"arn"`
	OutputFormat string            `json:"outputFormat,omitempty"`
	TargetArn    string            `json:"deliveryDestinationConfiguration,omitempty"`
	Policy       string            `json:"policy,omitempty"`
}

DeliveryDestination represents a CloudWatch Logs delivery destination.

type DeliverySource 

type DeliverySource struct {
	CreatedAt    time.Time         `json:"-"`
	Tags         map[string]string `json:"tags,omitempty"`
	Name         string            `json:"name"`
	Arn          string            `json:"arn"`
	LogType      string            `json:"logType,omitempty"`
	ResourceArns []string          `json:"resourceArns,omitempty"`
}

DeliverySource represents a CloudWatch Logs delivery source.

type ExportSink 

type ExportSink interface {
	// PutObject writes body to the given bucket under key. Implementations must
	// treat the call as a create/overwrite of a single object.
	PutObject(ctx context.Context, bucket, key string, body []byte) error
}

ExportSink is the minimal S3 write surface needed to materialise export tasks. The CloudWatch Logs export feature writes gzipped log data to a destination S3 bucket; injecting a sink keeps the backend decoupled from the S3 service while still performing real writes when wired at the server level.

type ExportTask 

type ExportTask struct {
	TaskName            string `json:"taskName,omitempty"`
	TaskID              string `json:"taskId"`
	LogGroupName        string `json:"logGroupName"`
	Destination         string `json:"destination"`
	DestinationPrefix   string `json:"destinationPrefix,omitempty"`
	LogStreamNamePrefix string `json:"logStreamNamePrefix,omitempty"`
	Status              string `json:"status"`
	StatusMessage       string `json:"statusMessage,omitempty"`
	From                int64  `json:"from"`
	To                  int64  `json:"to"`
	CreationTime        int64  `json:"creationTime"`
	CompletionTime      int64  `json:"completionTime,omitempty"`
}

ExportTask represents a CloudWatch Logs export task.

type FilterLogEventsParams 

type FilterLogEventsParams struct {
	StartTime           *int64
	EndTime             *int64
	GroupName           string
	FilterPattern       string
	NextToken           string
	LogStreamNamePrefix string
	StreamNames         []string
	Limit               int
}

FilterLogEventsParams holds the inputs for InMemoryBackend.FilterLogEvents.

type FilteredLogEvent 

type FilteredLogEvent struct {
	EventID       string `json:"eventId"`
	LogStreamName string `json:"logStreamName"`
	Message       string `json:"message"`
	IngestionTime int64  `json:"ingestionTime"`
	Timestamp     int64  `json:"timestamp"`
}

FilteredLogEvent represents a single matched event returned by FilterLogEvents. Unlike OutputLogEvent (used by GetLogEvents), it carries the originating log stream name and a unique eventId, matching the AWS FilteredLogEvent shape.

type Handler 

type Handler struct {
	Backend StorageBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP service handler for CloudWatch Logs operations.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new CloudWatch Logs handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this CloudWatch Logs instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource name from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns all mocked CloudWatch Logs operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for CloudWatch Logs requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority for the CloudWatch Logs handler.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all in-memory state from the backend and the handler-level tag store. It is used by the POST /_gopherstack/reset endpoint for CI pipelines and rapid local development.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by restoring both the backend state and the handler-owned tag data.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a matcher for CloudWatch Logs requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by serialising both the backend state and the handler-owned tag data.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker starts the background janitor if it is configured.

func (*Handler) WithJanitor 

func (h *Handler) WithJanitor(interval time.Duration, taskTimeout ...time.Duration) *Handler

WithJanitor attaches a background janitor to the handler. The janitor periodically evicts log events that have aged past their log group's retention policy. interval=0 uses the default of one minute. The optional taskTimeout bounds each sweep; 0 means no per-task timeout.

type ImportTask 

type ImportTask struct {
	ImportID             string `json:"importId"`
	ImportSourceArn      string `json:"importSourceArn"`
	ImportRoleArn        string `json:"importRoleArn"`
	ImportDestinationArn string `json:"importDestinationArn"`
	Status               string `json:"status"`
	CreationTime         int64  `json:"creationTime"`
	LastUpdatedTime      int64  `json:"lastUpdatedTime"`
}

ImportTask represents a CloudWatch Logs import task (from CloudTrail Lake).

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend implements StorageBackend using pkgs/store tables in place of the hand-rolled maps this backend used before Phase 3.3 (see store_setup.go).

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend with default configuration.

func NewInMemoryBackendWithConfig 

func NewInMemoryBackendWithConfig(accountID, region string) *InMemoryBackend

NewInMemoryBackendWithConfig creates a new InMemoryBackend with given account and region.

func NewInMemoryBackendWithContext 

func NewInMemoryBackendWithContext(
	svcCtx context.Context,
	accountID, region string,
) *InMemoryBackend

NewInMemoryBackendWithContext creates a new InMemoryBackend with the given parent context, account ID, and region. Subscription delivery goroutines are bounded by svcCtx so that they are cancelled on server shutdown. If svcCtx is nil, context.Background is used.

func (*InMemoryBackend) AddAnomalyInternal 

func (b *InMemoryBackend) AddAnomalyInternal(anomaly Anomaly)

AddAnomalyInternal seeds an Anomaly directly into the store for testing. The anomaly is stored under its AnomalyDetectorArn.

func (*InMemoryBackend) AddDeliveryInternal 

func (b *InMemoryBackend) AddDeliveryInternal(delivery Delivery)

AddDeliveryInternal seeds a Delivery directly into the store for testing. It overwrites any existing delivery with the same ID.

func (*InMemoryBackend) AddExportTaskInternal 

func (b *InMemoryBackend) AddExportTaskInternal(task ExportTask)

AddExportTaskInternal seeds an ExportTask directly into the store for testing. It overwrites any existing task with the same ID.

func (*InMemoryBackend) AddImportTaskInternal 

func (b *InMemoryBackend) AddImportTaskInternal(task ImportTask)

AddImportTaskInternal seeds an ImportTask directly into the store for testing. It overwrites any existing task with the same ID.

func (*InMemoryBackend) AddLogAnomalyDetectorInternal 

func (b *InMemoryBackend) AddLogAnomalyDetectorInternal(detector LogAnomalyDetector)

AddLogAnomalyDetectorInternal seeds a LogAnomalyDetector directly into the store for testing. It overwrites any existing detector with the same ARN.

func (*InMemoryBackend) AddScheduledQueryRunInternal 

func (b *InMemoryBackend) AddScheduledQueryRunInternal(
	scheduledQueryArn string,
	run ScheduledQueryRunSummary,
)

AddScheduledQueryRunInternal seeds a ScheduledQueryRunSummary for testing.

func (*InMemoryBackend) AssociateKmsKey 

func (b *InMemoryBackend) AssociateKmsKey(logGroupName, resourceIdentifier, kmsKeyID string) error

AssociateKmsKey associates a KMS key with a log group or query results resource. Exactly one of logGroupName or resourceIdentifier must be non-empty.

func (*InMemoryBackend) AssociateSourceToS3TableIntegration 

func (b *InMemoryBackend) AssociateSourceToS3TableIntegration(
	integrationArn, _, _ string,
) (string, error)

AssociateSourceToS3TableIntegration associates a data source with an S3 table integration. Returns a unique identifier for the association.

func (*InMemoryBackend) CancelExportTask 

func (b *InMemoryBackend) CancelExportTask(taskID string) error

CancelExportTask cancels a pending or running export task. Returns an error if the task is already in a terminal state.

func (*InMemoryBackend) CancelImportTask 

func (b *InMemoryBackend) CancelImportTask(importID string) (*ImportTask, error)

CancelImportTask cancels a running import task. Returns an error if the task is not in the ACTIVE state.

func (*InMemoryBackend) Close 

func (b *InMemoryBackend) Close()

Close cancels the lifecycle context, stops acceptance of new deliveries, and waits for all in-flight delivery goroutines to finish. After Close, PutLogEvents will no longer spawn delivery goroutines.

func (*InMemoryBackend) CreateDelivery 

func (b *InMemoryBackend) CreateDelivery(
	deliverySourceName, deliveryDestinationArn string,
	tags map[string]string,
) (*Delivery, error)

CreateDelivery creates a delivery between a delivery source and destination.

func (*InMemoryBackend) CreateExportTask 

func (b *InMemoryBackend) CreateExportTask(
	taskName, logGroupName, logStreamNamePrefix, destination, destinationPrefix string,
	from, to int64,
) (string, error)

CreateExportTask creates an export task to export log data to S3. Returns the task ID. When an S3 export sink is configured (see SetExportSink), the matching log events are written to the destination bucket as gzipped objects using the AWS key layout and the task completes synchronously; otherwise the task starts PENDING and advances by janitor age.

func (*InMemoryBackend) CreateImportTask 

func (b *InMemoryBackend) CreateImportTask(
	importRoleArn, importSourceArn string,
) (*ImportTask, error)

CreateImportTask creates an import task from a CloudTrail Lake event data store.

func (*InMemoryBackend) CreateLogAnomalyDetector 

func (b *InMemoryBackend) CreateLogAnomalyDetector(
	logGroupArnList []string,
	detectorName, evaluationFrequency, filterPattern, kmsKeyID string,
	anomalyVisibilityTime int64,
) (string, error)

CreateLogAnomalyDetector creates an anomaly detector for one or more log groups. Returns the ARN of the created detector.

func (*InMemoryBackend) CreateLogGroup 

func (b *InMemoryBackend) CreateLogGroup(
	ctx context.Context,
	name, logGroupClass, kmsKeyID string,
) (*LogGroup, error)

CreateLogGroup creates a new log group with the given class and optional KMS key. logGroupClass must be STANDARD or INFREQUENT_ACCESS (defaults to STANDARD if empty).

func (*InMemoryBackend) CreateLogStream 

func (b *InMemoryBackend) CreateLogStream(
	ctx context.Context,
	groupName, streamName string,
) (*LogStream, error)

CreateLogStream creates a new log stream within a log group.

func (*InMemoryBackend) CreateScheduledQuery 

func (b *InMemoryBackend) CreateScheduledQuery(
	name, queryString, scheduleExpression, _, state string,
) (string, error)

CreateScheduledQuery creates a scheduled CloudWatch Logs Insights query. Returns the ARN of the created scheduled query.

func (*InMemoryBackend) DeleteAccountPolicy 

func (b *InMemoryBackend) DeleteAccountPolicy(policyName, policyType string) error

DeleteAccountPolicy deletes a CloudWatch Logs account-level policy.

func (*InMemoryBackend) DeleteDataProtectionPolicy 

func (b *InMemoryBackend) DeleteDataProtectionPolicy(logGroupIdentifier string) error

DeleteDataProtectionPolicy removes the data protection policy for a log group.

func (*InMemoryBackend) DeleteDelivery 

func (b *InMemoryBackend) DeleteDelivery(id string) error

DeleteDelivery deletes a delivery by ID.

func (*InMemoryBackend) DeleteDeliveryDestination 

func (b *InMemoryBackend) DeleteDeliveryDestination(name string) error

DeleteDeliveryDestination removes a delivery destination by name.

func (*InMemoryBackend) DeleteDeliveryDestinationPolicy 

func (b *InMemoryBackend) DeleteDeliveryDestinationPolicy(name string) error

DeleteDeliveryDestinationPolicy removes the policy from a delivery destination.

func (*InMemoryBackend) DeleteDeliverySource 

func (b *InMemoryBackend) DeleteDeliverySource(name string) error

DeleteDeliverySource removes a delivery source by name.

func (*InMemoryBackend) DeleteDestination 

func (b *InMemoryBackend) DeleteDestination(name string) error

DeleteDestination removes a log routing destination.

func (*InMemoryBackend) DeleteIndexPolicy 

func (b *InMemoryBackend) DeleteIndexPolicy(logGroupIdentifier string) error

DeleteIndexPolicy removes the index policy for a log group.

func (*InMemoryBackend) DeleteIntegration 

func (b *InMemoryBackend) DeleteIntegration(name string) error

DeleteIntegration removes an integration by name.

func (*InMemoryBackend) DeleteLogAnomalyDetector 

func (b *InMemoryBackend) DeleteLogAnomalyDetector(detectorArn string) error

DeleteLogAnomalyDetector deletes a log anomaly detector.

func (*InMemoryBackend) DeleteLogGroup 

func (b *InMemoryBackend) DeleteLogGroup(ctx context.Context, name string) error

DeleteLogGroup deletes a log group and all its streams/events.

func (*InMemoryBackend) DeleteLogStream 

func (b *InMemoryBackend) DeleteLogStream(ctx context.Context, groupName, streamName string) error

DeleteLogStream deletes a log stream and all its events from a log group.

func (*InMemoryBackend) DeleteMetricFilter 

func (b *InMemoryBackend) DeleteMetricFilter(
	ctx context.Context,
	logGroupName, filterName string,
) error

DeleteMetricFilter deletes a metric filter from a log group.

func (*InMemoryBackend) DeleteQueryDefinition 

func (b *InMemoryBackend) DeleteQueryDefinition(queryDefinitionID string) error

DeleteQueryDefinition deletes a query definition by ID.

func (*InMemoryBackend) DeleteResourcePolicy 

func (b *InMemoryBackend) DeleteResourcePolicy(policyName string) error

DeleteResourcePolicy removes a resource policy by name.

func (*InMemoryBackend) DeleteScheduledQuery 

func (b *InMemoryBackend) DeleteScheduledQuery(scheduledQueryArn string) error

DeleteScheduledQuery deletes a scheduled query by ARN.

func (*InMemoryBackend) DeleteSubscriptionFilter 

func (b *InMemoryBackend) DeleteSubscriptionFilter(
	ctx context.Context,
	groupName, filterName string,
) error

DeleteSubscriptionFilter removes a subscription filter from a log group.

func (*InMemoryBackend) DeleteTransformer 

func (b *InMemoryBackend) DeleteTransformer(logGroupIdentifier string) error

DeleteTransformer removes the transformer for a log group.

func (*InMemoryBackend) DescribeAccountPolicies 

func (b *InMemoryBackend) DescribeAccountPolicies(
	policyType, policyName string,
	_ []string,
	limit int,
	nextToken string,
) ([]AccountPolicy, string, error)

DescribeAccountPolicies returns account-level policies, optionally filtered, with pagination. accountIdentifiers filters by account IDs embedded in the policy name (prefix match).

func (*InMemoryBackend) DescribeDeliveries 

func (b *InMemoryBackend) DescribeDeliveries(
	limit int,
	nextToken string,
) ([]Delivery, string, error)

DescribeDeliveries lists deliveries with pagination.

func (*InMemoryBackend) DescribeDeliveryDestinations 

func (b *InMemoryBackend) DescribeDeliveryDestinations() []DeliveryDestination

DescribeDeliveryDestinations returns all delivery destinations sorted by name.

func (*InMemoryBackend) DescribeDeliverySources 

func (b *InMemoryBackend) DescribeDeliverySources() []DeliverySource

DescribeDeliverySources returns all delivery sources sorted by name.

func (*InMemoryBackend) DescribeDestinations 

func (b *InMemoryBackend) DescribeDestinations(namePrefix string) []CWLDestination

DescribeDestinations returns destinations optionally filtered by name prefix.

func (*InMemoryBackend) DescribeExportTasks 

func (b *InMemoryBackend) DescribeExportTasks(
	taskID, statusCode string,
	limit int,
	nextToken string,
) ([]ExportTask, string, error)

DescribeExportTasks lists export tasks optionally filtered by task ID or status. It also lazily advances task state from PENDING→RUNNING→COMPLETED based on elapsed time.

func (*InMemoryBackend) DescribeImportTasks 

func (b *InMemoryBackend) DescribeImportTasks(
	taskID string,
	limit int,
	nextToken string,
) ([]ImportTask, string, error)

DescribeImportTasks lists import tasks optionally filtered by task ID.

func (*InMemoryBackend) DescribeIndexPolicies 

func (b *InMemoryBackend) DescribeIndexPolicies() []IndexPolicy

DescribeIndexPolicies returns all index policies sorted by log group identifier.

func (*InMemoryBackend) DescribeLogGroups 

func (b *InMemoryBackend) DescribeLogGroups(
	ctx context.Context, prefix, nextToken string, limit int,
) ([]LogGroup, string, error)

DescribeLogGroups returns log groups optionally filtered by prefix, with pagination.

func (*InMemoryBackend) DescribeLogStreams 

func (b *InMemoryBackend) DescribeLogStreams(
	ctx context.Context, groupName, prefix, nextToken, orderBy string, descending bool, limit int,
) (
	[]LogStream, string, error,
)

DescribeLogStreams returns log streams for a group, optionally filtered by prefix, with pagination. orderBy controls sort field: "LastEventTime" sorts by last event timestamp; anything else sorts by name. descending controls sort direction. AWS rules: descending=true with orderBy=LogStreamName is invalid; logStreamNamePrefix with orderBy=LastEventTime is invalid.

func (*InMemoryBackend) DescribeMetricFilters 

func (b *InMemoryBackend) DescribeMetricFilters(
	ctx context.Context,
	logGroupName, filterNamePrefix, metricName, metricNamespace, nextToken string,
	limit int,
) ([]MetricFilter, string, error)

DescribeMetricFilters lists metric filters with optional filters.

func (*InMemoryBackend) DescribeQueries 

func (b *InMemoryBackend) DescribeQueries(
	logGroupName, statusFilter, nextToken string, maxResults int,
) ([]QueryInfo, string, error)

DescribeQueries returns metadata about stored queries with optional filtering and pagination.

func (*InMemoryBackend) DescribeQueryDefinitions 

func (b *InMemoryBackend) DescribeQueryDefinitions(
	queryDefinitionNamePrefix string,
	limit int,
	nextToken string,
) ([]QueryDefinition, string, error)

DescribeQueryDefinitions lists query definitions optionally filtered by name prefix.

func (*InMemoryBackend) DescribeResourcePolicies 

func (b *InMemoryBackend) DescribeResourcePolicies() []ResourcePolicy

DescribeResourcePolicies returns all resource policies, sorted by name.

func (*InMemoryBackend) DescribeSubscriptionFilters 

func (b *InMemoryBackend) DescribeSubscriptionFilters(
	ctx context.Context, groupName, filterNamePrefix, nextToken string, limit int,
) (
	[]SubscriptionFilter, string, error,
)

DescribeSubscriptionFilters returns subscription filters for a log group with optional prefix and pagination.

func (*InMemoryBackend) DisassociateKmsKey 

func (b *InMemoryBackend) DisassociateKmsKey(logGroupName, resourceIdentifier string) error

DisassociateKmsKey removes the KMS key association from a log group or resource.

func (*InMemoryBackend) DiscoverLogFields 

func (b *InMemoryBackend) DiscoverLogFields(
	ctx context.Context,
	logGroupName string,
) ([]string, error)

DiscoverLogFields returns the set of field names discovered from the log events stored for the given log group. It always includes the system fields (@timestamp, @message, @ingestionTime, @logStream) and additionally parses any JSON-formatted event messages to surface their top-level keys. The returned slice is sorted for deterministic output. The log group must exist.

func (*InMemoryBackend) Drain 

func (b *InMemoryBackend) Drain()

Drain waits for all in-flight subscription delivery goroutines to complete without cancelling the lifecycle context. Primarily intended for tests.

func (*InMemoryBackend) FilterLogEvents 

func (b *InMemoryBackend) FilterLogEvents(
	ctx context.Context,
	p FilterLogEventsParams,
) ([]FilteredLogEvent, string, []SearchedLogStream, error)

FilterLogEvents searches events across streams in a group with an optional filter pattern. Results are interleaved across streams and sorted by event timestamp (ascending), matching AWS behaviour. The returned events carry the originating logStreamName and a deterministic eventId.

func (*InMemoryBackend) GetDataProtectionPolicy 

func (b *InMemoryBackend) GetDataProtectionPolicy(logGroupIdentifier string) (string, error)

GetDataProtectionPolicy returns the data protection policy for a log group. Returns an empty policy document if none has been set.

func (*InMemoryBackend) GetDelivery 

func (b *InMemoryBackend) GetDelivery(id string) (*Delivery, error)

GetDelivery returns a single delivery by ID.

func (*InMemoryBackend) GetDeliveryDestination 

func (b *InMemoryBackend) GetDeliveryDestination(name string) (*DeliveryDestination, error)

GetDeliveryDestination returns a delivery destination by name.

func (*InMemoryBackend) GetDeliveryDestinationPolicy 

func (b *InMemoryBackend) GetDeliveryDestinationPolicy(name string) (string, error)

GetDeliveryDestinationPolicy returns the policy for a delivery destination.

func (*InMemoryBackend) GetDeliverySource 

func (b *InMemoryBackend) GetDeliverySource(name string) (*DeliverySource, error)

GetDeliverySource returns a delivery source by name.

func (*InMemoryBackend) GetIntegration 

func (b *InMemoryBackend) GetIntegration(name string) (*CWLIntegration, error)

GetIntegration returns an integration by name.

func (*InMemoryBackend) GetLogAnomalyDetector 

func (b *InMemoryBackend) GetLogAnomalyDetector(detectorArn string) (*LogAnomalyDetector, error)

GetLogAnomalyDetector returns the anomaly detector with the given ARN.

func (*InMemoryBackend) GetLogEvents 

func (b *InMemoryBackend) GetLogEvents(
	ctx context.Context,
	groupName, streamName string,
	startTime, endTime *int64,
	limit int,
	nextToken string,
	startFromHead bool,
) ([]OutputLogEvent, string, string, error)

GetLogEvents returns events for a stream with optional time bounds, limit, and pagination. startFromHead controls the iteration direction:

  • true (start from oldest): begin at the oldest matching event.
  • false (AWS default when no nextToken is provided): begin at the newest events.

In practice the AWS SDK always passes a nextToken once pagination begins, at which point the token encodes the offset directly and startFromHead is ignored.

func (*InMemoryBackend) GetLogGroupFields 

func (b *InMemoryBackend) GetLogGroupFields(
	ctx context.Context,
	logGroupName string,
) ([]LogGroupField, error)

func (*InMemoryBackend) GetLogRecord 

func (b *InMemoryBackend) GetLogRecord(
	ctx context.Context,
	logRecordPointer string,
) (map[string]string, error)

GetLogRecord returns a single log event by its log record pointer. The pointer is the base64-encoded "<groupName>/<streamName>/<index>" string.

func (*InMemoryBackend) GetQueryResults 

func (b *InMemoryBackend) GetQueryResults(
	queryID string,
) ([][]ResultField, QueryStatistics, QueryStatus, error)

GetQueryResults returns the results of a previously started query.

func (*InMemoryBackend) GetScheduledQuery 

func (b *InMemoryBackend) GetScheduledQuery(scheduledQueryArn string) (*ScheduledQuery, error)

GetScheduledQuery returns the scheduled query with the given ARN.

func (*InMemoryBackend) GetScheduledQueryHistory 

func (b *InMemoryBackend) GetScheduledQueryHistory(
	scheduledQueryArn string,
	nextToken string,
	maxResults int,
) ([]ScheduledQueryRunSummary, string, error)

GetScheduledQueryHistory returns the execution history for a scheduled query.

func (*InMemoryBackend) GetTransformer 

func (b *InMemoryBackend) GetTransformer(logGroupIdentifier string) (*Transformer, error)

GetTransformer returns the transformer for a log group.

func (*InMemoryBackend) IsLogGroupDeletionProtected 

func (b *InMemoryBackend) IsLogGroupDeletionProtected(logGroupIdentifier string) bool

IsLogGroupDeletionProtected returns whether deletion protection is enabled.

func (*InMemoryBackend) ListAggregateLogGroupSummaries 

func (b *InMemoryBackend) ListAggregateLogGroupSummaries(
	ctx context.Context,
) []AggregateLogGroupSummary

ListAggregateLogGroupSummaries returns aggregate summaries derived from the real log groups and their stored events for the current region. Summaries are sorted by log group name for deterministic output.

func (*InMemoryBackend) ListAnomalies 

func (b *InMemoryBackend) ListAnomalies(
	anomalyDetectorArn string,
	limit int,
	nextToken string,
) ([]Anomaly, string, error)

ListAnomalies lists anomalies for the given anomaly detector ARN with pagination.

func (*InMemoryBackend) ListIntegrations 

func (b *InMemoryBackend) ListIntegrations() []CWLIntegration

ListIntegrations returns all integrations sorted by name.

func (*InMemoryBackend) ListLogAnomalyDetectors 

func (b *InMemoryBackend) ListLogAnomalyDetectors(
	filterLogGroupArnList []string,
	limit int,
	nextToken string,
) ([]LogAnomalyDetector, string, error)

ListLogAnomalyDetectors lists anomaly detectors, optionally filtered by log group ARN.

func (*InMemoryBackend) ListLogGroups 

func (b *InMemoryBackend) ListLogGroups(
	ctx context.Context, namePrefix, nextToken string, limit int,
) ([]LogGroup, string, error)

ListLogGroups is the newer paginated list operation, equivalent to DescribeLogGroups.

func (*InMemoryBackend) ListLogGroupsForQuery 

func (b *InMemoryBackend) ListLogGroupsForQuery(queryID string) ([]string, error)

ListLogGroupsForQuery returns the log group names that were used in a specific query.

func (*InMemoryBackend) ListScheduledQueries 

func (b *InMemoryBackend) ListScheduledQueries(
	limit int,
	nextToken string,
) ([]ScheduledQuery, string, error)

ListScheduledQueries lists all scheduled queries with pagination.

func (*InMemoryBackend) PutAccountPolicy 

func (b *InMemoryBackend) PutAccountPolicy(
	policyName, policyType, policyDocument, scope, selectionCriteria string,
) (*AccountPolicy, error)

PutAccountPolicy creates or updates an account-level policy. scope must be ALL or SELECTION_CRITERIA (defaults to ALL if empty).

func (*InMemoryBackend) PutDataProtectionPolicy 

func (b *InMemoryBackend) PutDataProtectionPolicy(logGroupIdentifier, policyDocument string) error

PutDataProtectionPolicy stores a data protection policy for a log group. policyDocument is stored as-is and returned verbatim by GetDataProtectionPolicy.

func (*InMemoryBackend) PutDeliveryDestination 

func (b *InMemoryBackend) PutDeliveryDestination(
	name, targetArn, outputFormat string,
	tags map[string]string,
) (*DeliveryDestination, error)

PutDeliveryDestination creates or updates a delivery destination.

func (*InMemoryBackend) PutDeliveryDestinationPolicy 

func (b *InMemoryBackend) PutDeliveryDestinationPolicy(name, policy string) error

PutDeliveryDestinationPolicy stores a policy on a delivery destination.

func (*InMemoryBackend) PutDeliverySource 

func (b *InMemoryBackend) PutDeliverySource(
	name, logType string,
	resourceArns []string,
	tags map[string]string,
) (*DeliverySource, error)

PutDeliverySource creates or updates a delivery source.

func (*InMemoryBackend) PutDestination 

func (b *InMemoryBackend) PutDestination(name, targetArn, roleArn string) (*CWLDestination, error)

PutDestination creates or updates a log routing destination.

func (*InMemoryBackend) PutDestinationPolicy 

func (b *InMemoryBackend) PutDestinationPolicy(name, policy string) error

PutDestinationPolicy attaches an access policy to a destination.

func (*InMemoryBackend) PutIndexPolicy 

func (b *InMemoryBackend) PutIndexPolicy(logGroupIdentifier, policyDocument string) (*IndexPolicy, error)

PutIndexPolicy creates or updates an index policy for a log group.

func (*InMemoryBackend) PutIntegration 

func (b *InMemoryBackend) PutIntegration(name, integrationType string) (*CWLIntegration, error)

PutIntegration creates or updates an integration.

func (*InMemoryBackend) PutLogEvents 

func (b *InMemoryBackend) PutLogEvents(
	ctx context.Context,
	groupName, streamName, _ string,
	events []InputLogEvent,
) (*PutLogEventsResult, error)

PutLogEvents appends log events to a stream and returns a PutLogEventsResult. sequenceToken is accepted for wire compatibility but, matching current AWS behavior (see aws-sdk-go-v2 cloudwatchlogs.PutLogEvents doc: "The sequence token is now ignored in PutLogEvents actions. PutLogEvents actions are always accepted and never return InvalidSequenceTokenException or DataAlreadyAcceptedException even if the sequence token is not valid."), it is never validated: PutLogEvents accepts concurrent, unordered, or stale tokens. Events with timestamps outside the allowed window are tracked in RejectedLogEventsInfo.

func (*InMemoryBackend) PutMetricFilter 

func (b *InMemoryBackend) PutMetricFilter(
	ctx context.Context,
	logGroupName, filterName, filterPattern string,
	transformations []MetricTransformation,
) error

PutMetricFilter creates or updates a metric filter for a log group.

func (*InMemoryBackend) PutQueryDefinition 

func (b *InMemoryBackend) PutQueryDefinition(
	name, queryString, queryDefinitionID string,
	logGroupNames []string,
) (string, error)

PutQueryDefinition creates or updates a query definition.

func (*InMemoryBackend) PutResourcePolicy 

func (b *InMemoryBackend) PutResourcePolicy(policyName, policyDocument string) (*ResourcePolicy, error)

PutResourcePolicy creates or updates a resource-based policy.

func (*InMemoryBackend) PutSubscriptionFilter 

func (b *InMemoryBackend) PutSubscriptionFilter(
	ctx context.Context,
	groupName, filterName, filterPattern, destinationArn, roleArn, distribution string,
) error

PutSubscriptionFilter creates or updates a subscription filter for a log group. roleArn is required by AWS when delivering to Kinesis streams; distribution defaults to Random.

func (*InMemoryBackend) PutTransformer 

func (b *InMemoryBackend) PutTransformer(logGroupIdentifier string, processors []map[string]any) error

PutTransformer creates or updates a log transformer.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all in-memory state from the backend. It is used by the POST /_gopherstack/reset endpoint for CI pipelines and rapid local development.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) SetDeliveryTimeout 

func (b *InMemoryBackend) SetDeliveryTimeout(d time.Duration)

SetDeliveryTimeout overrides the per-delivery timeout applied to each subscription filter call. A zero value disables the timeout. Primarily intended for tests.

func (*InMemoryBackend) SetDeliveryWorkers 

func (b *InMemoryBackend) SetDeliveryWorkers(n int)

SetDeliveryWorkers overrides the maximum number of concurrent subscription delivery goroutines. Must be called before the first PutLogEvents. Primarily intended for tests.

func (*InMemoryBackend) SetExportSink 

func (b *InMemoryBackend) SetExportSink(sink ExportSink)

SetExportSink configures the S3 sink used to materialise export tasks. When a sink is set, CreateExportTask writes matching events to S3 and completes the task synchronously; without one, tasks advance by janitor age (legacy path).

func (*InMemoryBackend) SetLogGroupDeletionProtection 

func (b *InMemoryBackend) SetLogGroupDeletionProtection(logGroupIdentifier string, protected bool) error

SetLogGroupDeletionProtection enables or disables deletion protection for a log group.

func (*InMemoryBackend) SetMaxQueries 

func (b *InMemoryBackend) SetMaxQueries(n int)

SetMaxQueries overrides the maximum number of queries retained in memory. A value of zero disables the cap. Primarily intended for tests.

func (*InMemoryBackend) SetMetricEmitter 

func (b *InMemoryBackend) SetMetricEmitter(e MetricEmitter)

SetMetricEmitter sets the emitter used to forward metric filter matches to CloudWatch.

func (*InMemoryBackend) SetQueryStatusInternal 

func (b *InMemoryBackend) SetQueryStatusInternal(queryID string, status QueryStatus)

SetQueryStatusInternal sets the status of an existing query for testing. Used to place a query into Running or Scheduled state before calling StopQuery.

func (*InMemoryBackend) SetQueryTTL 

func (b *InMemoryBackend) SetQueryTTL(d time.Duration)

SetQueryTTL overrides the TTL used to evict queries by age. A value of zero disables TTL-based eviction. Primarily intended for tests.

func (*InMemoryBackend) SetRetentionPolicy 

func (b *InMemoryBackend) SetRetentionPolicy(
	ctx context.Context,
	groupName string,
	days *int32,
) error

SetRetentionPolicy sets or clears the retention policy for a log group. A nil days value removes any existing retention policy.

func (*InMemoryBackend) SetSettings 

func (b *InMemoryBackend) SetSettings(s Settings)

SetSettings updates the backend settings.

func (*InMemoryBackend) SetSubscriptionDeliverer 

func (b *InMemoryBackend) SetSubscriptionDeliverer(d SubscriptionDeliverer)

SetSubscriptionDeliverer sets the deliverer used to forward log events to subscription filter destinations.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

Ephemeral, never-persisted state is deliberately excluded, matching this backend's behavior before Phase 3.3: Insights query results/cache (b.queries, b.parsedQueries, b.ephemeralRegistry) and the compiled filter pattern cache (b.compiledPatterns) are not part of backendSnapshot.

func (*InMemoryBackend) StartQuery 

func (b *InMemoryBackend) StartQuery(
	ctx context.Context,
	queryID, queryString string,
	logGroupNames []string,
	startTime, endTime int64,
) (*QueryInfo, error)

StartQuery stores a new insights query and executes it immediately against in-memory events.

func (*InMemoryBackend) StopQuery 

func (b *InMemoryBackend) StopQuery(queryID string) error

StopQuery cancels a query that is currently running or scheduled. AWS returns InvalidOperationException when stopping a query that is not in a running state.

func (*InMemoryBackend) TestMetricFilter 

func (b *InMemoryBackend) TestMetricFilter(
	filterPattern string,
	logEventMessages []string,
) ([]MetricFilterMatchRecord, error)

TestMetricFilter tests a metric filter pattern against provided log event messages.

func (*InMemoryBackend) UpdateAnomaly 

func (b *InMemoryBackend) UpdateAnomaly(
	anomalyID, anomalyDetectorArn, suppressionType string,
) error

UpdateAnomaly updates the suppression state of a stored anomaly.

func (*InMemoryBackend) UpdateDeliveryConfiguration 

func (b *InMemoryBackend) UpdateDeliveryConfiguration(id, fieldDelimiter string, recordFields []string) error

UpdateDeliveryConfiguration updates the field delimiter for a delivery.

func (*InMemoryBackend) UpdateLogAnomalyDetector 

func (b *InMemoryBackend) UpdateLogAnomalyDetector(
	detectorArn, evaluationFrequency string,
	anomalyVisibilityTime int64,
) error

UpdateLogAnomalyDetector updates evaluation frequency and/or anomaly visibility time.

func (*InMemoryBackend) UpdateScheduledQuery 

func (b *InMemoryBackend) UpdateScheduledQuery(scheduledQueryArn, state string) error

UpdateScheduledQuery updates the state of a scheduled query.

func (*InMemoryBackend) ValidateLiveTailLogGroups 

func (b *InMemoryBackend) ValidateLiveTailLogGroups(
	ctx context.Context,
	logGroupIdentifiers []string,
) error

ValidateLiveTailLogGroups validates that every supplied log group identifier resolves to an existing log group. StartLiveTail is a streaming (HTTP/2 event-stream) operation that cannot be meaningfully emulated over the standard JSON response, so the backend only performs input validation and returns ResourceNotFoundException for any unknown log group.

type IndexPolicy 

type IndexPolicy struct {
	LastUpdated        time.Time `json:"lastUpdateTime"`
	LogGroupIdentifier string    `json:"logGroupIdentifier"`
	PolicyDocument     string    `json:"policyDocument"`
}

IndexPolicy represents a CloudWatch Logs field index policy.

type InputLogEvent 

type InputLogEvent struct {
	Message   string `json:"message"`
	Timestamp int64  `json:"timestamp"`
}

InputLogEvent represents a single log event for PutLogEvents.

type Janitor 

type Janitor struct {
	Backend     *InMemoryBackend
	Interval    time.Duration
	TaskTimeout time.Duration
}

Janitor is the CloudWatch Logs background worker that enforces retention policies by evicting log events that have aged past their log group's RetentionInDays setting.

func NewJanitor 

func NewJanitor(backend *InMemoryBackend, interval time.Duration) *Janitor

NewJanitor creates a new Janitor for the given backend. A zero interval falls back to the default of one minute.

func (*Janitor) Run 

func (j *Janitor) Run(ctx context.Context)

Run runs the janitor loop until ctx is cancelled.

func (*Janitor) SweepOnce 

func (j *Janitor) SweepOnce(ctx context.Context)

SweepOnce runs a single retention sweep. Primarily intended for tests.

type LogAnomalyDetector 

type LogAnomalyDetector struct {
	AnomalyDetectorArn    string   `json:"anomalyDetectorArn"`
	DetectorName          string   `json:"detectorName,omitempty"`
	DetectorStatus        string   `json:"detectorStatus,omitempty"`
	EvaluationFrequency   string   `json:"evaluationFrequency,omitempty"`
	FilterPattern         string   `json:"filterPattern,omitempty"`
	KmsKeyID              string   `json:"kmsKeyId,omitempty"`
	LogGroupArnList       []string `json:"logGroupArnList"`
	AnomalyVisibilityTime int64    `json:"anomalyVisibilityTime,omitempty"`
	EvaluationLookback    int64    `json:"evaluationLookback,omitempty"`
	CreationTimeStamp     int64    `json:"creationTimeStamp"`
	LastModifiedTimeStamp int64    `json:"lastModifiedTimeStamp,omitempty"`
	FilterAnomalies       bool     `json:"filterAnomalies,omitempty"`
}

LogAnomalyDetector represents a CloudWatch Logs anomaly detector.

type LogGroup 

type LogGroup struct {
	RetentionInDays *int32 `json:"retentionInDays,omitempty"`
	LogGroupName    string `json:"logGroupName"`
	Arn             string `json:"arn"`
	LogGroupClass   string `json:"logGroupClass,omitempty"`
	KmsKeyID        string `json:"kmsKeyId,omitempty"`

	CreationTime      int64 `json:"creationTime"`
	StoredBytes       int64 `json:"storedBytes"`
	MetricFilterCount int32 `json:"metricFilterCount"`
	// contains filtered or unexported fields
}

LogGroup represents a CloudWatch Logs log group.

type LogGroupField 

type LogGroupField struct {
	Name    string `json:"name"`
	Percent int32  `json:"percent"`
}

LogGroupField is a field name and estimated percentage of log events that contain the field.

type LogStream 

type LogStream struct {
	FirstEventTimestamp *int64 `json:"firstEventTimestamp,omitempty"`
	LastEventTimestamp  *int64 `json:"lastEventTimestamp,omitempty"`
	LastIngestionTime   *int64 `json:"lastIngestionTime,omitempty"`
	LogStreamName       string `json:"logStreamName"`
	Arn                 string `json:"arn"`
	UploadSequenceToken string `json:"uploadSequenceToken"`

	CreationTime int64 `json:"creationTime"`
	StoredBytes  int64 `json:"storedBytes"`
	// contains filtered or unexported fields
}

LogStream represents a CloudWatch Logs log stream.

type MetricEmitter 

type MetricEmitter interface {
	// EmitMetric records a single metric data point with the given namespace, name, value, and unit.
	EmitMetric(namespace, name string, value float64, unit string) error
}

MetricEmitter emits a CloudWatch metric data point. It is implemented by the CloudWatch backend and injected into InMemoryBackend so that metric filter matches on PutLogEvents can be forwarded to CloudWatch.

type MetricEmitterFunc 

type MetricEmitterFunc func(namespace, name string, value float64, unit string) error

MetricEmitterFunc is a function adapter for MetricEmitter.

func (MetricEmitterFunc) EmitMetric 

func (f MetricEmitterFunc) EmitMetric(namespace, name string, value float64, unit string) error

EmitMetric implements MetricEmitter.

type MetricFilter 

type MetricFilter struct {
	RetentionInDays *int32 `json:"retentionInDays,omitempty"`
	FilterPattern   string `json:"filterPattern"`
	FilterName      string `json:"filterName"`
	LogGroupName    string `json:"logGroupName"`

	MetricTransformations []MetricTransformation `json:"metricTransformations"`
	CreationTime          int64                  `json:"creationTime"`
	// contains filtered or unexported fields
}

MetricFilter represents a CloudWatch Logs metric filter.

type MetricFilterMatchRecord 

type MetricFilterMatchRecord struct {
	ExtractedValues map[string]string `json:"extractedValues"`
	EventMessage    string            `json:"eventMessage"`
	EventNumber     int64             `json:"eventNumber"`
}

MetricFilterMatchRecord represents one event that matched a TestMetricFilter call.

type MetricTransformation 

type MetricTransformation struct {
	Dimensions      map[string]string `json:"dimensions,omitempty"`
	DefaultValue    *float64          `json:"defaultValue,omitempty"`
	MetricNamespace string            `json:"metricNamespace"`
	MetricName      string            `json:"metricName"`
	MetricValue     string            `json:"metricValue"`
	Unit            string            `json:"unit,omitempty"`
}

MetricTransformation describes how to extract a metric from a log event.

type OutputLogEvent 

type OutputLogEvent struct {
	Message       string `json:"message"`
	Ptr           string `json:"ptr,omitempty"`
	IngestionTime int64  `json:"ingestionTime"`
	Timestamp     int64  `json:"timestamp"`
}

OutputLogEvent represents a single log event returned by GetLogEvents.

type Provider 

type Provider struct{}

Provider implements service.Provider for the CloudWatch Logs service.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the CloudWatch Logs service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the logical name of the provider.

type PutLogEventsResult 

type PutLogEventsResult struct {
	RejectedLogEventsInfo *RejectedLogEventsInfo `json:"rejectedLogEventsInfo,omitempty"`
	NextSequenceToken     string                 `json:"nextSequenceToken"`
}

PutLogEventsResult is the result of a PutLogEvents call.

type QueryDefinition 

type QueryDefinition struct {
	QueryDefinitionID string   `json:"queryDefinitionId"`
	Name              string   `json:"name"`
	QueryString       string   `json:"queryString"`
	LogGroupNames     []string `json:"logGroupNames,omitempty"`
	LastModified      int64    `json:"lastModified"`
}

QueryDefinition represents a saved CloudWatch Logs Insights query definition.

type QueryInfo 

type QueryInfo struct {
	QueryID      string      `json:"queryId"`
	QueryString  string      `json:"queryString"`
	LogGroupName string      `json:"logGroupName,omitempty"`
	Status       QueryStatus `json:"status"`
	CreateTime   int64       `json:"createTime"`
}

QueryInfo contains metadata about a Logs Insights query.

type QueryStatistics 

type QueryStatistics struct {
	BytesScanned   float64 `json:"bytesScanned"`
	RecordsMatched float64 `json:"recordsMatched"`
	RecordsScanned float64 `json:"recordsScanned"`
}

QueryStatistics contains execution statistics for a Logs Insights query.

type QueryStatus 

type QueryStatus string

QueryStatus represents the lifecycle status of a Logs Insights query. 

const (
	QueryStatusScheduled QueryStatus = "Scheduled"
	QueryStatusRunning   QueryStatus = "Running"
	QueryStatusComplete  QueryStatus = "Complete"
	QueryStatusFailed    QueryStatus = "Failed"
	QueryStatusCancelled QueryStatus = "Cancelled"
)

type RejectedLogEventsInfo 

type RejectedLogEventsInfo struct {
	TooNewLogEventStartIndex *int32 `json:"tooNewLogEventStartIndex,omitempty"`
	TooOldLogEventEndIndex   *int32 `json:"tooOldLogEventEndIndex,omitempty"`
	ExpiredLogEventEndIndex  *int32 `json:"expiredLogEventEndIndex,omitempty"`
}

RejectedLogEventsInfo describes log events that were rejected by PutLogEvents. Field names/wire keys match aws-sdk-go-v2 types.RejectedLogEventsInfo exactly: TooOldLogEventEndIndex (not "...StartIndex") is the exclusive end index of the too-old run, mirroring ExpiredLogEventEndIndex's exclusive-end semantics.

type ResourcePolicy 

type ResourcePolicy struct {
	LastUpdated    time.Time `json:"-"`
	PolicyName     string    `json:"policyName"`
	PolicyDocument string    `json:"policyDocument"`
}

ResourcePolicy represents a CloudWatch Logs resource policy.

type ResultField 

type ResultField struct {
	Field string `json:"field"`
	Value string `json:"value"`
}

ResultField is a single field in a Logs Insights result row.

type ScheduledQuery 

type ScheduledQuery struct {
	Arn                string `json:"arn"`
	Name               string `json:"name"`
	QueryString        string `json:"queryString"`
	ScheduleExpression string `json:"scheduleExpression,omitempty"`
	State              string `json:"state"`
	CreationTime       int64  `json:"creationTime"`
}

ScheduledQuery represents a CloudWatch Logs scheduled query.

type ScheduledQueryRunSummary 

type ScheduledQueryRunSummary struct {
	Arn            string `json:"arn"`
	FailureReason  string `json:"failureReason,omitempty"`
	RunStatus      string `json:"runStatus"`
	ExecutionTime  int64  `json:"executionTime"`
	InvocationTime int64  `json:"invocationTime"`
}

ScheduledQueryRunSummary describes a single scheduled query execution.

type SearchedLogStream 

type SearchedLogStream struct {
	LogStreamName      string `json:"logStreamName"`
	SearchedCompletely bool   `json:"searchedCompletely"`
}

SearchedLogStream indicates whether a log stream was searched completely by FilterLogEvents. AWS deprecated populating this list (it returns empty) but the field remains part of the response shape.

type Settings 

type Settings struct {
	JanitorInterval  time.Duration `json:"janitor_interval"   env:"CLOUDWATCHLOGS_JANITOR_INTERVAL"   default:"1m" help:"Janitor tick interval."` //nolint:lll // long struct tags
	MaxRetentionDays int           ``                                                                                                             //nolint:lll // long struct tags
	/* 158-byte string literal not displayed */
}

Settings holds service-level configuration for the CloudWatch Logs backend. Fields are picked up by the Kong CLI parser when this struct is embedded in the root CLI command.

type StorageBackend 

type StorageBackend interface {
	CreateLogGroup(ctx context.Context, name, logGroupClass, kmsKeyID string) (*LogGroup, error)
	DeleteLogGroup(ctx context.Context, name string) error
	DescribeLogGroups(
		ctx context.Context,
		prefix, nextToken string,
		limit int,
	) ([]LogGroup, string, error)
	CreateLogStream(ctx context.Context, groupName, streamName string) (*LogStream, error)
	DeleteLogStream(ctx context.Context, groupName, streamName string) error
	DescribeLogStreams(
		ctx context.Context,
		groupName, prefix, nextToken, orderBy string,
		descending bool,
		limit int,
	) ([]LogStream, string, error)
	PutLogEvents(
		ctx context.Context, groupName, streamName, sequenceToken string, events []InputLogEvent,
	) (*PutLogEventsResult, error)
	GetLogEvents(
		ctx context.Context,
		groupName, streamName string,
		startTime, endTime *int64,
		limit int,
		nextToken string,
		startFromHead bool,
	) (
		[]OutputLogEvent, string, string, error)
	FilterLogEvents(ctx context.Context, p FilterLogEventsParams) (
		[]FilteredLogEvent, string, []SearchedLogStream, error)
	PutSubscriptionFilter(
		ctx context.Context, groupName, filterName, filterPattern, destinationArn, roleArn, distribution string,
	) error
	DescribeSubscriptionFilters(
		ctx context.Context,
		groupName, filterNamePrefix, nextToken string,
		limit int,
	) (
		[]SubscriptionFilter, string, error)
	DeleteSubscriptionFilter(ctx context.Context, groupName, filterName string) error
	SetRetentionPolicy(ctx context.Context, groupName string, days *int32) error
	StartQuery(
		ctx context.Context, queryID, queryString string, logGroupNames []string, startTime, endTime int64,
	) (*QueryInfo, error)
	GetQueryResults(queryID string) ([][]ResultField, QueryStatistics, QueryStatus, error)
	StopQuery(queryID string) error
	DescribeQueries(
		logGroupName, statusFilter, nextToken string,
		maxResults int,
	) ([]QueryInfo, string, error)

	// AssociateKmsKey associates a KMS key with a log group or query results resource.
	AssociateKmsKey(logGroupName, resourceIdentifier, kmsKeyID string) error
	// AssociateSourceToS3TableIntegration associates a data source with an S3 table integration.
	AssociateSourceToS3TableIntegration(
		integrationArn, dataSourceName, dataSourceType string,
	) (string, error)
	// CancelExportTask cancels a pending or running export task.
	CancelExportTask(taskID string) error
	// CancelImportTask cancels a running import task.
	CancelImportTask(importID string) (*ImportTask, error)
	// CreateDelivery creates a delivery between a delivery source and destination.
	CreateDelivery(
		deliverySourceName, deliveryDestinationArn string,
		tags map[string]string,
	) (*Delivery, error)
	// CreateExportTask creates an asynchronous export task to S3.
	CreateExportTask(
		taskName, logGroupName, logStreamNamePrefix, destination, destinationPrefix string,
		from, to int64,
	) (string, error)
	// CreateImportTask creates an import task from a CloudTrail Lake event data store.
	CreateImportTask(importRoleArn, importSourceArn string) (*ImportTask, error)
	// CreateLogAnomalyDetector creates an anomaly detector for one or more log groups.
	CreateLogAnomalyDetector(
		logGroupArnList []string,
		detectorName, evaluationFrequency, filterPattern, kmsKeyID string,
		anomalyVisibilityTime int64,
	) (string, error)
	// CreateScheduledQuery creates a scheduled CloudWatch Logs Insights query.
	CreateScheduledQuery(
		name, queryString, scheduleExpression, executionRoleArn, state string,
	) (string, error)
	// DeleteAccountPolicy deletes a CloudWatch Logs account-level policy.
	DeleteAccountPolicy(policyName, policyType string) error
	// DescribeExportTasks lists export tasks optionally filtered by task ID or status.
	DescribeExportTasks(
		taskID, statusCode string,
		limit int,
		nextToken string,
	) ([]ExportTask, string, error)
	// DescribeImportTasks lists import tasks optionally filtered by task ID.
	DescribeImportTasks(taskID string, limit int, nextToken string) ([]ImportTask, string, error)
	// DescribeDeliveries lists deliveries with pagination.
	DescribeDeliveries(limit int, nextToken string) ([]Delivery, string, error)
	// GetDelivery returns a single delivery by ID.
	GetDelivery(id string) (*Delivery, error)
	// DeleteDelivery deletes a delivery by ID.
	DeleteDelivery(id string) error
	// DeleteLogAnomalyDetector deletes a log anomaly detector.
	DeleteLogAnomalyDetector(detectorArn string) error
	// ListLogAnomalyDetectors lists anomaly detectors, optionally filtered by log group ARN.
	ListLogAnomalyDetectors(
		filterLogGroupArnList []string,
		limit int,
		nextToken string,
	) ([]LogAnomalyDetector, string, error)
	// UpdateLogAnomalyDetector updates evaluation frequency and/or anomaly visibility time.
	UpdateLogAnomalyDetector(
		detectorArn, evaluationFrequency string,
		anomalyVisibilityTime int64,
	) error
	// DeleteScheduledQuery deletes a scheduled query by ARN.
	DeleteScheduledQuery(scheduledQueryArn string) error
	// ListScheduledQueries lists all scheduled queries with pagination.
	ListScheduledQueries(limit int, nextToken string) ([]ScheduledQuery, string, error)
	// UpdateScheduledQuery updates the state of a scheduled query.
	UpdateScheduledQuery(scheduledQueryArn, state string) error
	// PutAccountPolicy creates or updates an account-level policy.
	PutAccountPolicy(
		policyName, policyType, policyDocument, scope, selectionCriteria string,
	) (*AccountPolicy, error)
	// DescribeAccountPolicies returns account-level policies, optionally filtered.
	DescribeAccountPolicies(
		policyType, policyName string,
		accountIdentifiers []string,
		limit int,
		nextToken string,
	) ([]AccountPolicy, string, error)
	// DisassociateKmsKey removes the KMS key association from a log group or resource.
	DisassociateKmsKey(logGroupName, resourceIdentifier string) error
	// PutMetricFilter creates or updates a metric filter for a log group.
	PutMetricFilter(
		ctx context.Context, logGroupName, filterName, filterPattern string, transformations []MetricTransformation,
	) error
	// DescribeMetricFilters lists metric filters with optional filters.
	DescribeMetricFilters(
		ctx context.Context,
		logGroupName, filterNamePrefix, metricName, metricNamespace, nextToken string,
		limit int,
	) ([]MetricFilter, string, error)
	// DeleteMetricFilter deletes a metric filter from a log group.
	DeleteMetricFilter(ctx context.Context, logGroupName, filterName string) error
	// TestMetricFilter tests a metric filter pattern against provided log event messages.
	TestMetricFilter(
		filterPattern string,
		logEventMessages []string,
	) ([]MetricFilterMatchRecord, error)
	// PutQueryDefinition creates or updates a query definition.
	PutQueryDefinition(
		name, queryString, queryDefinitionID string,
		logGroupNames []string,
	) (string, error)
	// DescribeQueryDefinitions lists query definitions optionally filtered by name prefix.
	DescribeQueryDefinitions(
		queryDefinitionNamePrefix string,
		limit int,
		nextToken string,
	) ([]QueryDefinition, string, error)
	// DeleteQueryDefinition deletes a query definition by ID.
	DeleteQueryDefinition(queryDefinitionID string) error
	// GetLogAnomalyDetector returns the anomaly detector with the given ARN.
	GetLogAnomalyDetector(detectorArn string) (*LogAnomalyDetector, error)
	// GetScheduledQuery returns the scheduled query with the given ARN.
	GetScheduledQuery(scheduledQueryArn string) (*ScheduledQuery, error)
	// GetLogGroupFields returns the most common log fields for a log group.
	GetLogGroupFields(ctx context.Context, logGroupName string) ([]LogGroupField, error)
	// GetLogRecord returns a single log event by its log record pointer.
	GetLogRecord(ctx context.Context, logRecordPointer string) (map[string]string, error)
	// ListAnomalies lists anomalies for the given anomaly detector ARN with pagination.
	ListAnomalies(anomalyDetectorArn string, limit int, nextToken string) ([]Anomaly, string, error)
	// ListLogGroupsForQuery returns the log group names used in a specific query.
	ListLogGroupsForQuery(queryID string) ([]string, error)
	// GetScheduledQueryHistory returns the execution history for a scheduled query.
	GetScheduledQueryHistory(
		scheduledQueryArn string,
		nextToken string,
		maxResults int,
	) ([]ScheduledQueryRunSummary, string, error)
	// UpdateAnomaly updates anomaly suppression settings. No actual anomaly data is stored.
	UpdateAnomaly(anomalyID, anomalyDetectorArn string, suppressionType string) error
	// ListLogGroups is the newer paginated list operation, equivalent to DescribeLogGroups.
	ListLogGroups(
		ctx context.Context,
		namePrefix, nextToken string,
		limit int,
	) ([]LogGroup, string, error)
}

StorageBackend is the interface for a CloudWatch Logs in-memory store.

type SubscriptionDeliverer 

type SubscriptionDeliverer interface {
	// DeliverLogEvents delivers a gzipped, base64-encoded CloudWatch Logs payload to destinationArn.
	DeliverLogEvents(ctx context.Context, destinationArn string, payload []byte) error
}

SubscriptionDeliverer delivers encoded log event payloads to a subscription filter destination.

type SubscriptionDelivererFunc 

type SubscriptionDelivererFunc func(ctx context.Context, destinationArn string, payload []byte) error

SubscriptionDelivererFunc is a function adapter for SubscriptionDeliverer.

func (SubscriptionDelivererFunc) DeliverLogEvents 

func (f SubscriptionDelivererFunc) DeliverLogEvents(
	ctx context.Context,
	destinationArn string,
	payload []byte,
) error

DeliverLogEvents implements SubscriptionDeliverer.

type SubscriptionFilter 

type SubscriptionFilter struct {
	FilterPattern  string `json:"filterPattern"`
	FilterName     string `json:"filterName"`
	LogGroupName   string `json:"logGroupName"`
	DestinationArn string `json:"destinationArn"`
	RoleArn        string `json:"roleArn,omitempty"`
	Distribution   string `json:"distribution,omitempty"`

	CreationTime int64 `json:"creationTime"`
	// contains filtered or unexported fields
}

SubscriptionFilter represents a CloudWatch Logs subscription filter.

type TestTransformerOutput 

type TestTransformerOutput struct {
	EventMessage            string `json:"eventMessage"`
	TransformedEventMessage string `json:"transformedEventMessage"`
	EventNumber             int64  `json:"eventNumber"`
}

TestTransformerOutput is a single transformed log event result. It mirrors the AWS TransformedLogRecord shape, carrying both the original and transformed message plus the 1-based event number.

func ApplyTransformer 

func ApplyTransformer(
	messages []string,
	processors []map[string]any,
) []TestTransformerOutput

ApplyTransformer applies the supplied transformer processors to the supplied sample log event messages and returns the transformed results. The transform is deterministic: processors are applied in order to each event. Supported processors mirror a useful subset of the AWS transformer grammar:

  • addKeys: add fixed key/value entries to the (JSON) event
  • deleteKeys: remove keys from the (JSON) event
  • renameKeys: rename keys within the (JSON) event
  • lowerCaseString / upperCaseString: case-fold named string fields
  • copyValue: copy one field's value into another

Events that are not JSON objects are passed through unchanged for JSON-oriented processors. Unknown processors are ignored.

type Transformer 

type Transformer struct {
	CreatedAt          time.Time        `json:"-"`
	LogGroupIdentifier string           `json:"logGroupIdentifier"`
	Processors         []map[string]any `json:"transformerConfig"`
}

Transformer represents a CloudWatch Logs log transformer.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.