cloudwatchlogs

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: MIT Imports: 35 Imported by: 0

README

CloudWatch Logs

Parity grade: A · SDK aws-sdk-go-v2/service/cloudwatchlogs@v1.80.0 · last audited 2026-07-25 (3884816a)

Coverage

Metric Value
Operations audited 69 (69 ok)
Feature families 1 (1 ok)
Known gaps 8
Deferred items 3
Resource leaks clean
Known gaps
  • MetricTransformation.Dimensions is accepted, validated on the wire, and persisted on the MetricFilter, but is never forwarded to the emitted CloudWatch metric: the MetricEmitter interface (backend.go) only carries namespace/name/value/unit, and its real implementation is wired in cli.go's wireCWLogsMetricEmitter, which is out of scope for this pass (SHARED FILE). Extending the interface + cli.go wiring to carry dimensions is a real fix but requires touching cli.go. (bd: gopherstack-b14)
  • ScheduledQuery only models a subset of the real GetScheduledQueryOutput shape (arn/name/queryString/scheduleExpression/state/creationTime). Missing: description, destinationConfiguration (nested types.DestinationConfiguration), executionRoleArn (accepted as CreateScheduledQuery input per the handler test but silently discarded -- never stored or threaded through to the model), lastExecutionStatus, lastTriggeredTime, lastUpdatedTime, logGroupIdentifiers, queryLanguage, scheduleEndTime, scheduleStartTime, startTimeOffset, timezone. Not implemented this pass: threading ~10 new fields (one nested) through Create/Update/Get plus new enum validation (QueryLanguage, ScheduledQueryState already covered) is a substantial feature addition, lower priority than the wire-key/dropped-field bugs actually fixed this pass. (bd: gopherstack-b14)
  • CreateDelivery does not accept FieldDelimiter, RecordFields, or S3DeliveryConfiguration, all real fields on CreateDeliveryInput (RecordFields is documented as sometimes mandatory: "If the delivery's log source has mandatory fields, they must be included in this list"). The Delivery model has RecordFields/FieldDelimiter json tags but CreateDelivery's signature never takes them as parameters, so they are always empty. Delivery also carries a CreationTime field with no equivalent in the real types.Delivery at all (a harmless extra key on the wire, but not a real field) and is missing DeliveryDestinationType/S3DeliveryConfiguration. Not implemented this pass. (bd: gopherstack-b14)
  • AccountPolicy is missing AccountId and LastUpdatedTime, both real flat fields on types.AccountPolicy. Not implemented this pass (lower priority than the wire-key bugs fixed elsewhere this pass). (bd: gopherstack-b14)
  • DescribeDestinations does not implement Limit/NextToken pagination (real DescribeDestinationsInput accepts both); it always returns the complete unpaginated list. Not implemented this pass. (bd: gopherstack-b14)
  • SyslogConfiguration's VpcEndpointId is accepted/stored/returned as an opaque string, never cross-validated against real EC2 VPC-endpoint state -- there is no VPC-endpoint modeling anywhere in this service, and no established cross-service ARN/ID validation pattern anywhere in this codebase to reuse (this backend already treats KmsKeyId/RoleArn/DestinationArn the same way elsewhere). Not implemented this pass; would require either a cross-service backend dependency or a shared registry that does not currently exist.
  • LookupTable's ARN (arn:{partition}:logs:{region}:{account}:lookup-table:{name}) is constructed by analogy to this codebase's existing log-group ARN convention, not confirmed against an authoritative AWS source: no smithy model ships with the installed aws-sdk-go-v2 module and no ARN pattern appears in any doc comment for LookupTableArn. If a future pass finds the real pattern differs, only lookupTableARN (lookup_tables.go) needs to change.
  • IndexPolicy/Transformer (pre-existing, prior pass) still accept any logGroupIdentifier string without checking it resolves to a real log group, unlike the new PutSyslogConfiguration added this pass (which does validate). Noted here for consistency awareness, not fixed this pass (out of scope: pre-existing ops, not part of the parity-4 SDK-bump op set this pass covers).
Deferred
  • Insights query language/stages/parser correctness (insights_expr.go, insights_parse.go, insights_parser.go, insights_stages.go, insights_stats.go) -- not re-verified op-by-op against CloudWatch Logs Insights query syntax this pass.
  • Data Protection/Resource/Index Policies, Transformers, Integrations, Account Policies (top-level shapes spot-checked flat/no-nested-object-bugs this pass, but not exhaustively re-audited field-by-field op-by-op) -- see the "account policies, data protection/resource/index policies, transformers, integrations" family note and the AccountPolicy gap above.
  • StartLiveTail streaming transport (intentionally out of scope; validation-only by design).

More

Documentation

Index

Constants

View Source 
const (
	LogGroupClassStandard         = "STANDARD"
	LogGroupClassInfrequentAccess = "INFREQUENT_ACCESS"
)

LogGroupClass constants match the AWS CloudWatch Logs API enum.

View Source 
const (
	DistributionRandom      = "Random"
	DistributionByLogStream = "ByLogStream"
)

Distribution constants for subscription filter event routing.

View Source 
const (
	StorageTierStandard           = "STANDARD"
	StorageTierIntelligentTiering = "INTELLIGENT_TIERING"
)

StorageTier constants match the real aws-sdk-go-v2 types.StorageTier enum (StorageTierStandard/StorageTierIntelligentTiering).

Variables

View Source 
var (
	ErrLogGroupNotFound              = errors.New("ResourceNotFoundException")
	ErrLogGroupAlreadyExists         = errors.New("ResourceAlreadyExistsException")
	ErrLogStreamNotFound             = errors.New("ResourceNotFoundException")
	ErrLogStreamAlreadyExist         = errors.New("ResourceAlreadyExistsException")
	ErrSubscriptionFilterNotFound    = errors.New("ResourceNotFoundException")
	ErrSubscriptionFilterLimitExceed = errors.New("LimitExceededException")
	ErrQueryNotFound                 = errors.New("ResourceNotFoundException")
	ErrExportTaskNotFound            = errors.New("ResourceNotFoundException")
	ErrImportTaskNotFound            = errors.New("ResourceNotFoundException")
	ErrValidation                    = errors.New("InvalidParameterException")
	ErrDeliveryNotFound              = errors.New("ResourceNotFoundException")
	ErrLogAnomalyDetectorNotFound    = errors.New("ResourceNotFoundException")
	ErrScheduledQueryNotFound        = errors.New("ResourceNotFoundException")
	ErrMetricFilterNotFound          = errors.New("ResourceNotFoundException")
	ErrQueryDefinitionNotFound       = errors.New("ResourceNotFoundException")
	ErrOperationAborted              = errors.New("OperationAbortedException")
	ErrInvalidOperation              = errors.New("InvalidOperationException")
)
View Source 
var (
	ErrResourcePolicyNotFound      = errors.New("ResourceNotFoundException")
	ErrDeliveryDestinationNotFound = errors.New("ResourceNotFoundException")
	ErrDeliverySourceNotFound      = errors.New("ResourceNotFoundException")
	ErrDestinationNotFound         = errors.New("ResourceNotFoundException")
	ErrIndexPolicyNotFound         = errors.New("ResourceNotFoundException")
	ErrTransformerNotFound         = errors.New("ResourceNotFoundException")
	ErrIntegrationNotFound         = errors.New("ResourceNotFoundException")
)
View Source 
var (
	ErrLookupTableNotFound         = errors.New("ResourceNotFoundException")
	ErrLookupTableAlreadyExists    = errors.New("ResourceAlreadyExistsException")
	ErrSyslogConfigurationNotFound = errors.New("ResourceNotFoundException")
)
View Source 
var ErrNilAppContext = errors.New("AppContext is required")

ErrNilAppContext is returned when Provider.Init is called with a nil AppContext.

View Source 
var ErrParseExpr = errors.New("parse expression")

ErrParseExpr indicates a malformed Insights expression.

Functions

This section is empty.

Types

type AccountPolicy 

type AccountPolicy struct {
	PolicyName        string `json:"policyName"`
	PolicyType        string `json:"policyType"`
	PolicyDocument    string `json:"policyDocument,omitempty"`
	Scope             string `json:"scope,omitempty"`
	SelectionCriteria string `json:"selectionCriteria,omitempty"`
	AccountID         string `json:"accountId,omitempty"`
	LastUpdatedTime   int64  `json:"lastUpdatedTime,omitempty"`
}

AccountPolicy represents a CloudWatch Logs account-level policy, field-diffed against aws-sdk-go-v2 types.AccountPolicy: accountId and lastUpdatedTime were both missing from a previous revision, so a real client's AccountId/LastUpdatedTime fields were always left unpopulated.

type AggregateLogGroupSummary 

type AggregateLogGroupSummary struct {
	LogGroupName  string `json:"logGroupName"`
	LogGroupArn   string `json:"logGroupArn"`
	LogGroupClass string `json:"logGroupClass,omitempty"`
	StoredBytes   int64  `json:"storedBytes"`
	LogEventCount int64  `json:"logEventCount"`
}

AggregateLogGroupSummary describes aggregated statistics for a single log group.

type Anomaly 

type Anomaly struct {
	AnomalyDetectorArn string `json:"anomalyDetectorArn"`
	AnomalyID          string `json:"anomalyId"`
	Description        string `json:"description"`
	SuppressedState    string `json:"suppressedState,omitempty"`
	FirstSeen          int64  `json:"firstSeen"`
	LastSeen           int64  `json:"lastSeen"`
	SuppressedDate     int64  `json:"suppressedDate,omitempty"`
	Active             bool   `json:"active"`
}

Anomaly represents a detected log anomaly.

type CWLDestination 

type CWLDestination struct {
	CreatedAt       time.Time `json:"-"`
	DestinationName string    `json:"destinationName"`
	TargetArn       string    `json:"targetArn"`
	RoleArn         string    `json:"roleArn"`
	AccessPolicy    string    `json:"accessPolicy,omitempty"`
	Arn             string    `json:"arn"`
}

CWLDestination represents a CloudWatch Logs log routing destination.

type CWLIntegration 

type CWLIntegration struct {
	CreatedAt time.Time `json:"-"`
	Name      string    `json:"integrationName"`
	Type      string    `json:"integrationType"`
	Status    string    `json:"integrationStatus"`
}

CWLIntegration represents a CloudWatch Logs integration (e.g. OpenSearch).

type ConfigProvider 

type ConfigProvider interface {
	GetCloudWatchLogsSettings() Settings
}

ConfigProvider is a private interface to extract CloudWatch Logs configuration from the abstract AppContext Config.

type Delivery 

type Delivery struct {
	Tags                    map[string]string        `json:"tags,omitempty"`
	S3DeliveryConfiguration *DeliveryS3Configuration `json:"s3DeliveryConfiguration,omitempty"`
	ID                      string                   `json:"id"`
	Arn                     string                   `json:"arn"`
	DeliverySourceName      string                   `json:"deliverySourceName"`
	DeliveryDestinationArn  string                   `json:"deliveryDestinationArn"`
	FieldDelimiter          string                   `json:"fieldDelimiter,omitempty"`
	RecordFields            []string                 `json:"recordFields,omitempty"`
	CreationTime            int64                    `json:"-"`
}

Delivery represents a CloudWatch Logs delivery configuration. CreationTime is backend bookkeeping only (used to order DescribeDeliveries) and must never reach the wire: the real Delivery type (aws-sdk-go-v2 types.Delivery) has no creationTime member at all -- an earlier revision fabricated one.

type DeliveryDestination 

type DeliveryDestination struct {
	CreatedAt               time.Time         `json:"-"`
	Tags                    map[string]string `json:"tags,omitempty"`
	Name                    string            `json:"name"`
	Arn                     string            `json:"arn"`
	OutputFormat            string            `json:"outputFormat,omitempty"`
	TargetArn               string            `json:"deliveryDestinationConfiguration,omitempty"`
	DeliveryDestinationType string            `json:"deliveryDestinationType,omitempty"`
	Policy                  string            `json:"policy,omitempty"`
}

DeliveryDestination represents a CloudWatch Logs delivery destination. These json tags describe this backend's own internal snapshot/persistence encoding, not the AWS wire shape: the real aws-sdk-go-v2 types. DeliveryDestination nests the target resource ARN under a deliveryDestinationConfiguration.destinationResourceArn object (not a bare string under that key, as TargetArn's tag alone would suggest) and carries a separate deliveryDestinationType enum field; Policy is not part of this type at all on the wire (it is returned by the dedicated GetDeliveryDestinationPolicy operation instead). See deliveryDestinationWireShape in handler_deliveries.go for the actual AWS-shaped response mapping used by the handlers.

type DeliveryS3Configuration added in v1.2.0 

type DeliveryS3Configuration struct {
	SuffixPath               string `json:"suffixPath,omitempty"`
	EnableHiveCompatiblePath bool   `json:"enableHiveCompatiblePath,omitempty"`
}

DeliveryS3Configuration mirrors the real S3DeliveryConfiguration shape (aws-sdk-go-v2 types.S3DeliveryConfiguration): parameters that apply only when a delivery's destination is an S3 bucket.

type DeliverySource 

type DeliverySource struct {
	CreatedAt    time.Time         `json:"-"`
	Tags         map[string]string `json:"tags,omitempty"`
	Name         string            `json:"name"`
	Arn          string            `json:"arn"`
	LogType      string            `json:"logType,omitempty"`
	Service      string            `json:"service,omitempty"`
	ResourceArns []string          `json:"resourceArns,omitempty"`
}

DeliverySource represents a CloudWatch Logs delivery source. Service is not client-supplied (aws-sdk-go-v2 types.PutDeliverySourceInput has no such field); AWS derives it server-side from the ARN of the resource that is actually sending logs (types.DeliverySource.Service doc: "The Amazon Web Services service that is sending logs"), so this backend derives it the same way -- see serviceFromARN in deliveries.go.

type ExportSink 

type ExportSink interface {
	// PutObject writes body to the given bucket under key. Implementations must
	// treat the call as a create/overwrite of a single object.
	PutObject(ctx context.Context, bucket, key string, body []byte) error
}

ExportSink is the minimal S3 write surface needed to materialise export tasks. The CloudWatch Logs export feature writes gzipped log data to a destination S3 bucket; injecting a sink keeps the backend decoupled from the S3 service while still performing real writes when wired at the server level.

type ExportTask 

type ExportTask struct {
	TaskName            string `json:"taskName,omitempty"`
	TaskID              string `json:"taskId"`
	LogGroupName        string `json:"logGroupName"`
	Destination         string `json:"destination"`
	DestinationPrefix   string `json:"destinationPrefix,omitempty"`
	LogStreamNamePrefix string `json:"logStreamNamePrefix,omitempty"`
	Status              string `json:"status"`
	StatusMessage       string `json:"statusMessage,omitempty"`
	From                int64  `json:"from"`
	To                  int64  `json:"to"`
	CreationTime        int64  `json:"creationTime"`
	CompletionTime      int64  `json:"completionTime,omitempty"`
}

ExportTask represents a CloudWatch Logs export task.

type FilterLogEventsParams 

type FilterLogEventsParams struct {
	StartTime           *int64
	EndTime             *int64
	GroupName           string
	FilterPattern       string
	NextToken           string
	LogStreamNamePrefix string
	StreamNames         []string
	Limit               int
}

FilterLogEventsParams holds the inputs for InMemoryBackend.FilterLogEvents.

type FilteredLogEvent 

type FilteredLogEvent struct {
	EventID       string `json:"eventId"`
	LogStreamName string `json:"logStreamName"`
	Message       string `json:"message"`
	IngestionTime int64  `json:"ingestionTime"`
	Timestamp     int64  `json:"timestamp"`
}

FilteredLogEvent represents a single matched event returned by FilterLogEvents. Unlike OutputLogEvent (used by GetLogEvents), it carries the originating log stream name and a unique eventId, matching the AWS FilteredLogEvent shape.

type Handler 

type Handler struct {
	Backend StorageBackend
	// contains filtered or unexported fields
}

Handler is the Echo HTTP service handler for CloudWatch Logs operations.

func NewHandler 

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new CloudWatch Logs handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this CloudWatch Logs instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource name from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns all mocked CloudWatch Logs operations.

func (*Handler) GetTagsForResource added in v1.2.0 

func (h *Handler) GetTagsForResource(resourceARN string) map[string]string

GetTagsForResource returns the tags for the resource identified by resourceARN.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for CloudWatch Logs requests.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority for the CloudWatch Logs handler.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all in-memory state from the backend and the handler-level tag store. It is used by the POST /_gopherstack/reset endpoint for CI pipelines and rapid local development.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by restoring both the backend state and the handler-owned tag data.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a matcher for CloudWatch Logs requests.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by serialising both the backend state and the handler-owned tag data.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker starts the background janitor if it is configured.

func (*Handler) TagResource added in v1.2.0 

func (h *Handler) TagResource(resourceARN string, kv map[string]string)

TagResource adds or updates tags on the resource identified by resourceARN, the same store the "TagResource" action (below) writes through h.setTags. Exported for cross-service tagging (resourcegroupstaggingapi, wired in cli.go's wireTaggingCloudWatchLogs).

func (*Handler) TaggedResources added in v1.2.0 

func (h *Handler) TaggedResources() []TaggedEntry

TaggedResources returns every tagged resource whose h.tags key is itself a full ARN (starts with "arn:"). The legacy TagLogGroup/ListTagsLogGroup/UntagLogGroup actions key this same map by bare log group name instead (see logTagActions' "TagLogGroup" case below), so a log group tagged only through those legacy actions has no ARN-keyed entry to report here -- this backend does not unify the two keys for the same log group, matching its existing (pre-existing, out of scope here) behavior.

func (*Handler) UntagResource added in v1.2.0 

func (h *Handler) UntagResource(resourceARN string, keys []string)

UntagResource removes tag keys from the resource identified by resourceARN.

func (*Handler) WithJanitor 

func (h *Handler) WithJanitor(interval time.Duration, taskTimeout ...time.Duration) *Handler

WithJanitor attaches a background janitor to the handler. The janitor periodically evicts log events that have aged past their log group's retention policy. interval=0 uses the default of one minute. The optional taskTimeout bounds each sweep; 0 means no per-task timeout.

type ImportTask 

type ImportTask struct {
	ImportID             string `json:"importId"`
	ImportSourceArn      string `json:"importSourceArn"`
	ImportRoleArn        string `json:"-"`
	ImportDestinationArn string `json:"importDestinationArn"`
	Status               string `json:"importStatus"`
	CreationTime         int64  `json:"creationTime"`
	LastUpdatedTime      int64  `json:"lastUpdatedTime"`
}

ImportTask represents a CloudWatch Logs import task (from CloudTrail Lake). Status values must be one of the real aws-sdk-go-v2 types.ImportStatus enum members: IN_PROGRESS, CANCELLED, COMPLETED, FAILED (NOT "ACTIVE"/"SUCCEEDED", which are not real CloudWatch Logs import statuses). The wire key for this field is importStatus (aws-sdk-go-v2 types.Import.ImportStatus), not status; ImportRoleArn is accepted on CreateImportTask but is deliberately not part of the real Import describe/list shape (types.Import has no such field), so it is kept here for this backend's own bookkeeping but is excluded when serialized to the wire (see wireImportTask in handler_export_tasks.go).

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend implements StorageBackend using pkgs/store tables in place of the hand-rolled maps this backend used before Phase 3.3 (see store_setup.go).

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend with default configuration.

func NewInMemoryBackendWithConfig 

func NewInMemoryBackendWithConfig(accountID, region string) *InMemoryBackend

NewInMemoryBackendWithConfig creates a new InMemoryBackend with given account and region.

func NewInMemoryBackendWithContext 

func NewInMemoryBackendWithContext(
	svcCtx context.Context,
	accountID, region string,
) *InMemoryBackend

NewInMemoryBackendWithContext creates a new InMemoryBackend with the given parent context, account ID, and region. Subscription delivery goroutines are bounded by svcCtx so that they are cancelled on server shutdown. If svcCtx is nil, context.Background is used.

func (*InMemoryBackend) AddAnomalyInternal 

func (b *InMemoryBackend) AddAnomalyInternal(anomaly Anomaly)

AddAnomalyInternal seeds an Anomaly directly into the store for testing. The anomaly is stored under its AnomalyDetectorArn.

func (*InMemoryBackend) AddDeliveryInternal 

func (b *InMemoryBackend) AddDeliveryInternal(delivery Delivery)

AddDeliveryInternal seeds a Delivery directly into the store for testing. It overwrites any existing delivery with the same ID.

func (*InMemoryBackend) AddExportTaskInternal 

func (b *InMemoryBackend) AddExportTaskInternal(task ExportTask)

AddExportTaskInternal seeds an ExportTask directly into the store for testing. It overwrites any existing task with the same ID.

func (*InMemoryBackend) AddImportTaskInternal 

func (b *InMemoryBackend) AddImportTaskInternal(task ImportTask)

AddImportTaskInternal seeds an ImportTask directly into the store for testing. It overwrites any existing task with the same ID.

func (*InMemoryBackend) AddLogAnomalyDetectorInternal 

func (b *InMemoryBackend) AddLogAnomalyDetectorInternal(detector LogAnomalyDetector)

AddLogAnomalyDetectorInternal seeds a LogAnomalyDetector directly into the store for testing. It overwrites any existing detector with the same ARN.

func (*InMemoryBackend) AddScheduledQueryRunInternal 

func (b *InMemoryBackend) AddScheduledQueryRunInternal(
	scheduledQueryArn string,
	run ScheduledQueryRunSummary,
)

AddScheduledQueryRunInternal seeds a ScheduledQueryRunSummary for testing.

func (*InMemoryBackend) AssociateKmsKey 

func (b *InMemoryBackend) AssociateKmsKey(logGroupName, resourceIdentifier, kmsKeyID string) error

AssociateKmsKey associates a KMS key with a log group or query results resource. Exactly one of logGroupName or resourceIdentifier must be non-empty.

func (*InMemoryBackend) AssociateSourceToS3TableIntegration 

func (b *InMemoryBackend) AssociateSourceToS3TableIntegration(
	integrationArn, _, _ string,
) (string, error)

AssociateSourceToS3TableIntegration associates a data source with an S3 table integration. Returns a unique identifier for the association.

func (*InMemoryBackend) CancelExportTask 

func (b *InMemoryBackend) CancelExportTask(taskID string) error

CancelExportTask cancels a pending or running export task. Returns an error if the task is already in a terminal state.

func (*InMemoryBackend) CancelImportTask 

func (b *InMemoryBackend) CancelImportTask(importID string) (*ImportTask, error)

CancelImportTask cancels a running import task. Returns an error if the task is not in the ACTIVE state.

func (*InMemoryBackend) Close 

func (b *InMemoryBackend) Close()

Close cancels the lifecycle context, stops acceptance of new deliveries, and waits for all in-flight delivery goroutines to finish. After Close, PutLogEvents will no longer spawn delivery goroutines.

func (*InMemoryBackend) CreateDelivery 

func (b *InMemoryBackend) CreateDelivery(
	deliverySourceName, deliveryDestinationArn, fieldDelimiter string,
	recordFields []string,
	s3Config *DeliveryS3Configuration,
	tags map[string]string,
) (*Delivery, error)

CreateDelivery creates a delivery between a delivery source and destination. fieldDelimiter, recordFields, and s3Config are set at creation time, matching real CreateDeliveryInput (confirmed via serializers.go's awsAwsjson11_serializeOpDocumentCreateDeliveryInput: fieldDelimiter/ recordFields/s3DeliveryConfiguration are all top-level CreateDeliveryInput members) -- an earlier revision only exposed these via the separate UpdateDeliveryConfiguration op, so a real client that set them on create (as the real API allows) had them silently dropped.

func (*InMemoryBackend) CreateExportTask 

func (b *InMemoryBackend) CreateExportTask(
	taskName, logGroupName, logStreamNamePrefix, destination, destinationPrefix string,
	from, to int64,
) (string, error)

CreateExportTask creates an export task to export log data to S3. Returns the task ID. When an S3 export sink is configured (see SetExportSink), the matching log events are written to the destination bucket as gzipped objects using the AWS key layout and the task completes synchronously; otherwise the task starts PENDING and advances by janitor age.

func (*InMemoryBackend) CreateImportTask 

func (b *InMemoryBackend) CreateImportTask(
	importRoleArn, importSourceArn string,
) (*ImportTask, error)

CreateImportTask creates an import task from a CloudTrail Lake event data store.

func (*InMemoryBackend) CreateLogAnomalyDetector 

func (b *InMemoryBackend) CreateLogAnomalyDetector(
	logGroupArnList []string,
	detectorName, evaluationFrequency, filterPattern, kmsKeyID string,
	anomalyVisibilityTime int64,
) (string, error)

CreateLogAnomalyDetector creates an anomaly detector for one or more log groups. Returns the ARN of the created detector.

func (*InMemoryBackend) CreateLogGroup 

func (b *InMemoryBackend) CreateLogGroup(
	ctx context.Context,
	name, logGroupClass, kmsKeyID string,
) (*LogGroup, error)

CreateLogGroup creates a new log group with the given class and optional KMS key. logGroupClass must be STANDARD or INFREQUENT_ACCESS (defaults to STANDARD if empty).

func (*InMemoryBackend) CreateLogStream 

func (b *InMemoryBackend) CreateLogStream(
	ctx context.Context,
	groupName, streamName string,
) (*LogStream, error)

CreateLogStream creates a new log stream within a log group.

func (*InMemoryBackend) CreateLookupTable added in v1.2.0 

func (b *InMemoryBackend) CreateLookupTable(
	name, tableBody, description, kmsKeyID string,
) (*LookupTable, error)

CreateLookupTable creates a new lookup table from real CSV content (see the LookupTable doc comment in models.go for why this backend stores/parses TableBody directly rather than referencing S3).

func (*InMemoryBackend) CreateScheduledQuery 

func (b *InMemoryBackend) CreateScheduledQuery(p ScheduledQueryCreateParams) (string, error)

CreateScheduledQuery creates a scheduled CloudWatch Logs Insights query. Returns the ARN of the created scheduled query. Field-diffed against CreateScheduledQueryInput: p.ExecutionRoleArn and p.QueryLanguage are both real required members -- a previous revision accepted executionRoleArn from the wire but silently discarded it (never stored, never returned), and never modeled queryLanguage at all, so a real client's required queryLanguage was accepted without validation and dropped.

func (*InMemoryBackend) DeleteAccountPolicy 

func (b *InMemoryBackend) DeleteAccountPolicy(policyName, policyType string) error

DeleteAccountPolicy deletes a CloudWatch Logs account-level policy.

func (*InMemoryBackend) DeleteDataProtectionPolicy 

func (b *InMemoryBackend) DeleteDataProtectionPolicy(logGroupIdentifier string) error

DeleteDataProtectionPolicy removes the data protection policy for a log group.

func (*InMemoryBackend) DeleteDelivery 

func (b *InMemoryBackend) DeleteDelivery(id string) error

DeleteDelivery deletes a delivery by ID.

func (*InMemoryBackend) DeleteDeliveryDestination 

func (b *InMemoryBackend) DeleteDeliveryDestination(name string) error

DeleteDeliveryDestination removes a delivery destination by name.

func (*InMemoryBackend) DeleteDeliveryDestinationPolicy 

func (b *InMemoryBackend) DeleteDeliveryDestinationPolicy(name string) error

DeleteDeliveryDestinationPolicy removes the policy from a delivery destination.

func (*InMemoryBackend) DeleteDeliverySource 

func (b *InMemoryBackend) DeleteDeliverySource(name string) error

DeleteDeliverySource removes a delivery source by name.

func (*InMemoryBackend) DeleteDestination 

func (b *InMemoryBackend) DeleteDestination(name string) error

DeleteDestination removes a log routing destination.

func (*InMemoryBackend) DeleteIndexPolicy 

func (b *InMemoryBackend) DeleteIndexPolicy(logGroupIdentifier string) error

DeleteIndexPolicy removes the index policy for a log group.

func (*InMemoryBackend) DeleteIntegration 

func (b *InMemoryBackend) DeleteIntegration(name string) error

DeleteIntegration removes an integration by name.

func (*InMemoryBackend) DeleteLogAnomalyDetector 

func (b *InMemoryBackend) DeleteLogAnomalyDetector(detectorArn string) error

DeleteLogAnomalyDetector deletes a log anomaly detector.

func (*InMemoryBackend) DeleteLogGroup 

func (b *InMemoryBackend) DeleteLogGroup(ctx context.Context, name string) error

DeleteLogGroup deletes a log group and all its streams/events.

func (*InMemoryBackend) DeleteLogStream 

func (b *InMemoryBackend) DeleteLogStream(ctx context.Context, groupName, streamName string) error

DeleteLogStream deletes a log stream and all its events from a log group.

func (*InMemoryBackend) DeleteLookupTable added in v1.2.0 

func (b *InMemoryBackend) DeleteLookupTable(lookupTableArn string) error

DeleteLookupTable permanently deletes a lookup table by ARN.

func (*InMemoryBackend) DeleteMetricFilter 

func (b *InMemoryBackend) DeleteMetricFilter(
	ctx context.Context,
	logGroupName, filterName string,
) error

DeleteMetricFilter deletes a metric filter from a log group.

func (*InMemoryBackend) DeleteQueryDefinition 

func (b *InMemoryBackend) DeleteQueryDefinition(queryDefinitionID string) error

DeleteQueryDefinition deletes a query definition by ID.

func (*InMemoryBackend) DeleteResourcePolicy 

func (b *InMemoryBackend) DeleteResourcePolicy(policyName string) error

DeleteResourcePolicy removes a resource policy by name.

func (*InMemoryBackend) DeleteScheduledQuery 

func (b *InMemoryBackend) DeleteScheduledQuery(scheduledQueryArn string) error

DeleteScheduledQuery deletes a scheduled query by ARN.

func (*InMemoryBackend) DeleteSubscriptionFilter 

func (b *InMemoryBackend) DeleteSubscriptionFilter(
	ctx context.Context,
	groupName, filterName string,
) error

DeleteSubscriptionFilter removes a subscription filter from a log group.

func (*InMemoryBackend) DeleteSyslogConfiguration added in v1.2.0 

func (b *InMemoryBackend) DeleteSyslogConfiguration(logGroupIdentifier, vpcEndpointID string) error

DeleteSyslogConfiguration removes the syslog configuration for a log group. When vpcEndpointID is non-empty it must match the stored configuration's VPC endpoint, or the delete is treated as not-found (mirrors DeleteSyslogConfigurationInput accepting an optional VpcEndpointId scoping parameter).

func (*InMemoryBackend) DeleteTransformer 

func (b *InMemoryBackend) DeleteTransformer(logGroupIdentifier string) error

DeleteTransformer removes the transformer for a log group.

func (*InMemoryBackend) DescribeAccountPolicies 

func (b *InMemoryBackend) DescribeAccountPolicies(
	policyType, policyName string,
	_ []string,
	limit int,
	nextToken string,
) ([]AccountPolicy, string, error)

DescribeAccountPolicies returns account-level policies, optionally filtered, with pagination. accountIdentifiers filters by account IDs embedded in the policy name (prefix match).

func (*InMemoryBackend) DescribeDeliveries 

func (b *InMemoryBackend) DescribeDeliveries(
	limit int,
	nextToken string,
) ([]Delivery, string, error)

DescribeDeliveries lists deliveries with pagination.

func (*InMemoryBackend) DescribeDeliveryDestinations 

func (b *InMemoryBackend) DescribeDeliveryDestinations() []DeliveryDestination

DescribeDeliveryDestinations returns all delivery destinations sorted by name.

func (*InMemoryBackend) DescribeDeliverySources 

func (b *InMemoryBackend) DescribeDeliverySources() []DeliverySource

DescribeDeliverySources returns all delivery sources sorted by name.

func (*InMemoryBackend) DescribeDestinations 

func (b *InMemoryBackend) DescribeDestinations(
	namePrefix string,
	limit int,
	nextToken string,
) ([]CWLDestination, string)

DescribeDestinations returns destinations optionally filtered by name prefix, with pagination. Field-diffed against DescribeDestinationsInput/ Output (api_op_DescribeDestinations.go): limit/nextToken were previously unmodeled entirely, so a real client paging through more destinations than fit in one response had no way to fetch subsequent pages -- every call silently returned the complete, unpaginated result set instead.

func (*InMemoryBackend) DescribeExportTasks 

func (b *InMemoryBackend) DescribeExportTasks(
	taskID, statusCode string,
	limit int,
	nextToken string,
) ([]ExportTask, string, error)

DescribeExportTasks lists export tasks optionally filtered by task ID or status. It also lazily advances task state from PENDING→RUNNING→COMPLETED based on elapsed time.

func (*InMemoryBackend) DescribeImportTasks 

func (b *InMemoryBackend) DescribeImportTasks(
	taskID string,
	limit int,
	nextToken string,
) ([]ImportTask, string, error)

DescribeImportTasks lists import tasks optionally filtered by task ID.

func (*InMemoryBackend) DescribeIndexPolicies 

func (b *InMemoryBackend) DescribeIndexPolicies() []IndexPolicy

DescribeIndexPolicies returns all index policies sorted by log group identifier.

func (*InMemoryBackend) DescribeLogGroups 

func (b *InMemoryBackend) DescribeLogGroups(
	ctx context.Context, prefix, nextToken string, limit int,
) ([]LogGroup, string, error)

DescribeLogGroups returns log groups optionally filtered by prefix, with pagination.

func (*InMemoryBackend) DescribeLogStreams 

func (b *InMemoryBackend) DescribeLogStreams(
	ctx context.Context, groupName, prefix, nextToken, orderBy string, descending bool, limit int,
) (
	[]LogStream, string, error,
)

DescribeLogStreams returns log streams for a group, optionally filtered by prefix, with pagination. orderBy controls sort field: "LastEventTime" sorts by last event timestamp; anything else sorts by name. descending controls sort direction. AWS rules: descending=true with orderBy=LogStreamName is invalid; logStreamNamePrefix with orderBy=LastEventTime is invalid.

func (*InMemoryBackend) DescribeLookupTables added in v1.2.0 

func (b *InMemoryBackend) DescribeLookupTables(
	namePrefix, nextToken string, limit int,
) ([]LookupTable, string)

DescribeLookupTables returns lookup table metadata (no TableBody -- see the real DescribeLookupTablesOutput's LookupTables shape, types.LookupTable, which has no such field), optionally filtered by name prefix, with pagination.

func (*InMemoryBackend) DescribeMetricFilters 

func (b *InMemoryBackend) DescribeMetricFilters(
	ctx context.Context,
	logGroupName, filterNamePrefix, metricName, metricNamespace, nextToken string,
	limit int,
) ([]MetricFilter, string, error)

DescribeMetricFilters lists metric filters with optional filters.

func (*InMemoryBackend) DescribeQueries 

func (b *InMemoryBackend) DescribeQueries(
	logGroupName, statusFilter, nextToken string, maxResults int,
) ([]QueryInfo, string, error)

DescribeQueries returns metadata about stored queries with optional filtering and pagination.

func (*InMemoryBackend) DescribeQueryDefinitions 

func (b *InMemoryBackend) DescribeQueryDefinitions(
	queryDefinitionNamePrefix string,
	limit int,
	nextToken string,
) ([]QueryDefinition, string, error)

DescribeQueryDefinitions lists query definitions optionally filtered by name prefix.

func (*InMemoryBackend) DescribeResourcePolicies 

func (b *InMemoryBackend) DescribeResourcePolicies() []ResourcePolicy

DescribeResourcePolicies returns all resource policies, sorted by name.

func (*InMemoryBackend) DescribeSubscriptionFilters 

func (b *InMemoryBackend) DescribeSubscriptionFilters(
	ctx context.Context, groupName, filterNamePrefix, nextToken string, limit int,
) (
	[]SubscriptionFilter, string, error,
)

DescribeSubscriptionFilters returns subscription filters for a log group with optional prefix and pagination.

func (*InMemoryBackend) DisassociateKmsKey 

func (b *InMemoryBackend) DisassociateKmsKey(logGroupName, resourceIdentifier string) error

DisassociateKmsKey removes the KMS key association from a log group or resource.

func (*InMemoryBackend) DiscoverLogFields 

func (b *InMemoryBackend) DiscoverLogFields(
	ctx context.Context,
	logGroupName string,
) ([]string, error)

DiscoverLogFields returns the set of field names discovered from the log events stored for the given log group. It always includes the system fields (@timestamp, @message, @ingestionTime, @logStream) and additionally parses any JSON-formatted event messages to surface their top-level keys. The returned slice is sorted for deterministic output. The log group must exist.

func (*InMemoryBackend) Drain 

func (b *InMemoryBackend) Drain()

Drain waits for all in-flight subscription delivery goroutines to complete without cancelling the lifecycle context. Primarily intended for tests.

func (*InMemoryBackend) FilterLogEvents 

func (b *InMemoryBackend) FilterLogEvents(
	ctx context.Context,
	p FilterLogEventsParams,
) ([]FilteredLogEvent, string, []SearchedLogStream, error)

FilterLogEvents searches events across streams in a group with an optional filter pattern. Results are interleaved across streams and sorted by event timestamp (ascending), matching AWS behaviour. The returned events carry the originating logStreamName and a deterministic eventId.

func (*InMemoryBackend) GetDataProtectionPolicy 

func (b *InMemoryBackend) GetDataProtectionPolicy(logGroupIdentifier string) (string, error)

GetDataProtectionPolicy returns the data protection policy for a log group. Returns an empty policy document if none has been set.

func (*InMemoryBackend) GetDelivery 

func (b *InMemoryBackend) GetDelivery(id string) (*Delivery, error)

GetDelivery returns a single delivery by ID.

func (*InMemoryBackend) GetDeliveryDestination 

func (b *InMemoryBackend) GetDeliveryDestination(name string) (*DeliveryDestination, error)

GetDeliveryDestination returns a delivery destination by name.

func (*InMemoryBackend) GetDeliveryDestinationPolicy 

func (b *InMemoryBackend) GetDeliveryDestinationPolicy(name string) (string, error)

GetDeliveryDestinationPolicy returns the policy for a delivery destination.

func (*InMemoryBackend) GetDeliverySource 

func (b *InMemoryBackend) GetDeliverySource(name string) (*DeliverySource, error)

GetDeliverySource returns a delivery source by name.

func (*InMemoryBackend) GetIntegration 

func (b *InMemoryBackend) GetIntegration(name string) (*CWLIntegration, error)

GetIntegration returns an integration by name.

func (*InMemoryBackend) GetLogAnomalyDetector 

func (b *InMemoryBackend) GetLogAnomalyDetector(detectorArn string) (*LogAnomalyDetector, error)

GetLogAnomalyDetector returns the anomaly detector with the given ARN.

func (*InMemoryBackend) GetLogEvents 

func (b *InMemoryBackend) GetLogEvents(
	ctx context.Context,
	groupName, streamName string,
	startTime, endTime *int64,
	limit int,
	nextToken string,
	startFromHead bool,
) ([]OutputLogEvent, string, string, error)

GetLogEvents returns events for a stream with optional time bounds, limit, and pagination. startFromHead controls the iteration direction:

  • true (start from oldest): begin at the oldest matching event.
  • false (AWS default when no nextToken is provided): begin at the newest events.

In practice the AWS SDK always passes a nextToken once pagination begins, at which point the token encodes the offset directly and startFromHead is ignored.

func (*InMemoryBackend) GetLogGroupFields 

func (b *InMemoryBackend) GetLogGroupFields(
	ctx context.Context,
	logGroupName string,
	timeSec *int64,
) ([]LogGroupField, error)

GetLogGroupFields returns the fields discovered in log events sampled from the log group's streams within the search window (see logGroupFieldsWindow), each paired with the percentage of sampled events that contained it. The four built-in fields (@message/@timestamp/@ingestionTime/@logStream) are present on every real log event, so they are counted like any other field rather than hardcoded at 100%. Real AWS discovers additional fields by parsing JSON-formatted messages; jsonMessageFields (shared with DiscoverLogFields/GetLogFields) does the same here. Results are sorted by descending percentage (AWS's documented order), then by name for determinism on ties. An empty (non-nil) slice is returned when no events fall in the window, matching "percentage of log events queried" having no defined value over zero queried events.

func (*InMemoryBackend) GetLogRecord 

func (b *InMemoryBackend) GetLogRecord(
	ctx context.Context,
	logRecordPointer string,
) (map[string]string, error)

GetLogRecord returns a single log event by its log record pointer. The pointer is the base64-encoded "<groupName>/<streamName>/<index>" string.

func (*InMemoryBackend) GetLookupTable added in v1.2.0 

func (b *InMemoryBackend) GetLookupTable(lookupTableArn string) (*LookupTable, error)

GetLookupTable returns the full content (including TableBody) of a lookup table by ARN.

func (*InMemoryBackend) GetQueryResults 

func (b *InMemoryBackend) GetQueryResults(
	queryID string,
) ([][]ResultField, QueryStatistics, QueryStatus, error)

GetQueryResults returns the results of a previously started query.

func (*InMemoryBackend) GetScheduledQuery 

func (b *InMemoryBackend) GetScheduledQuery(scheduledQueryArn string) (*ScheduledQuery, error)

GetScheduledQuery returns the scheduled query with the given ARN.

func (*InMemoryBackend) GetScheduledQueryHistory 

func (b *InMemoryBackend) GetScheduledQueryHistory(
	scheduledQueryArn string,
	nextToken string,
	maxResults int,
) ([]ScheduledQueryRunSummary, string, error)

GetScheduledQueryHistory returns the execution history for a scheduled query.

func (*InMemoryBackend) GetStorageTierPolicy added in v1.2.0 

func (b *InMemoryBackend) GetStorageTierPolicy() StorageTierPolicy

GetStorageTierPolicy returns the account-level storage tier policy (see the StorageTierPolicy doc comment in models.go for why this is a singleton, not per-log-group). Before any PutStorageTierPolicy call, real AWS's default active tier is STANDARD with no LastUpdatedTime (GetStorageTierPolicyOutput.LastUpdatedTime is a nilable *int64), so an empty table synthesizes that default rather than requiring a Put first.

func (*InMemoryBackend) GetTransformer 

func (b *InMemoryBackend) GetTransformer(logGroupIdentifier string) (*Transformer, error)

GetTransformer returns the transformer for a log group.

func (*InMemoryBackend) IsLogGroupDeletionProtected 

func (b *InMemoryBackend) IsLogGroupDeletionProtected(logGroupIdentifier string) bool

IsLogGroupDeletionProtected returns whether deletion protection is enabled.

func (*InMemoryBackend) ListAggregateLogGroupSummaries 

func (b *InMemoryBackend) ListAggregateLogGroupSummaries(
	ctx context.Context,
) []AggregateLogGroupSummary

ListAggregateLogGroupSummaries returns aggregate summaries derived from the real log groups and their stored events for the current region. Summaries are sorted by log group name for deterministic output.

func (*InMemoryBackend) ListAnomalies 

func (b *InMemoryBackend) ListAnomalies(
	anomalyDetectorArn string,
	limit int,
	nextToken string,
) ([]Anomaly, string, error)

ListAnomalies lists anomalies for the given anomaly detector ARN with pagination.

func (*InMemoryBackend) ListIntegrations 

func (b *InMemoryBackend) ListIntegrations() []CWLIntegration

ListIntegrations returns all integrations sorted by name.

func (*InMemoryBackend) ListLogAnomalyDetectors 

func (b *InMemoryBackend) ListLogAnomalyDetectors(
	filterLogGroupArnList []string,
	limit int,
	nextToken string,
) ([]LogAnomalyDetector, string, error)

ListLogAnomalyDetectors lists anomaly detectors, optionally filtered by log group ARN.

func (*InMemoryBackend) ListLogGroups 

func (b *InMemoryBackend) ListLogGroups(
	ctx context.Context, namePrefix, nextToken string, limit int,
) ([]LogGroup, string, error)

ListLogGroups is the newer paginated list operation, equivalent to DescribeLogGroups.

func (*InMemoryBackend) ListLogGroupsForQuery 

func (b *InMemoryBackend) ListLogGroupsForQuery(queryID string) ([]string, error)

ListLogGroupsForQuery returns the log group names that were used in a specific query.

func (*InMemoryBackend) ListScheduledQueries 

func (b *InMemoryBackend) ListScheduledQueries(
	limit int,
	nextToken string,
) ([]ScheduledQuery, string, error)

ListScheduledQueries lists all scheduled queries with pagination.

func (*InMemoryBackend) ListSyslogConfigurations added in v1.2.0 

func (b *InMemoryBackend) ListSyslogConfigurations(
	logGroupIdentifier, vpcEndpointID, nextToken string, limit int,
) ([]SyslogConfiguration, string)

ListSyslogConfigurations returns syslog configurations optionally filtered by log group identifier and/or VPC endpoint ID, with pagination.

func (*InMemoryBackend) PutAccountPolicy 

func (b *InMemoryBackend) PutAccountPolicy(
	policyName, policyType, policyDocument, scope, selectionCriteria string,
) (*AccountPolicy, error)

PutAccountPolicy creates or updates an account-level policy. scope must be ALL or SELECTION_CRITERIA (defaults to ALL if empty).

func (*InMemoryBackend) PutDataProtectionPolicy 

func (b *InMemoryBackend) PutDataProtectionPolicy(logGroupIdentifier, policyDocument string) error

PutDataProtectionPolicy stores a data protection policy for a log group. policyDocument is stored as-is and returned verbatim by GetDataProtectionPolicy.

func (*InMemoryBackend) PutDeliveryDestination 

func (b *InMemoryBackend) PutDeliveryDestination(
	name, targetArn, outputFormat, destinationType string,
	tags map[string]string,
) (*DeliveryDestination, error)

PutDeliveryDestination creates or updates a delivery destination. destinationType, when non-empty, must be one of S3/CWL/FH/XRAY.

func (*InMemoryBackend) PutDeliveryDestinationPolicy 

func (b *InMemoryBackend) PutDeliveryDestinationPolicy(name, policy string) error

PutDeliveryDestinationPolicy stores a policy on a delivery destination.

func (*InMemoryBackend) PutDeliverySource 

func (b *InMemoryBackend) PutDeliverySource(
	name, logType string,
	resourceArns []string,
	tags map[string]string,
) (*DeliverySource, error)

PutDeliverySource creates or updates a delivery source. service is derived from the first resource ARN (see serviceFromARN), matching real AWS, which does not accept it as client input.

func (*InMemoryBackend) PutDestination 

func (b *InMemoryBackend) PutDestination(name, targetArn, roleArn string) (*CWLDestination, error)

PutDestination creates or updates a log routing destination.

func (*InMemoryBackend) PutDestinationPolicy 

func (b *InMemoryBackend) PutDestinationPolicy(name, policy string) error

PutDestinationPolicy attaches an access policy to a destination.

func (*InMemoryBackend) PutIndexPolicy 

func (b *InMemoryBackend) PutIndexPolicy(logGroupIdentifier, policyDocument string) (*IndexPolicy, error)

PutIndexPolicy creates or updates an index policy for a log group.

func (*InMemoryBackend) PutIntegration 

func (b *InMemoryBackend) PutIntegration(name, integrationType string) (*CWLIntegration, error)

PutIntegration creates or updates an integration.

func (*InMemoryBackend) PutLogEvents 

func (b *InMemoryBackend) PutLogEvents(
	ctx context.Context,
	groupName, streamName, _ string,
	events []InputLogEvent,
) (*PutLogEventsResult, error)

PutLogEvents appends log events to a stream and returns a PutLogEventsResult. sequenceToken is accepted for wire compatibility but, matching current AWS behavior (see aws-sdk-go-v2 cloudwatchlogs.PutLogEvents doc: "The sequence token is now ignored in PutLogEvents actions. PutLogEvents actions are always accepted and never return InvalidSequenceTokenException or DataAlreadyAcceptedException even if the sequence token is not valid."), it is never validated: PutLogEvents accepts concurrent, unordered, or stale tokens. Events with timestamps outside the allowed window are tracked in RejectedLogEventsInfo.

func (*InMemoryBackend) PutMetricFilter 

func (b *InMemoryBackend) PutMetricFilter(
	ctx context.Context,
	logGroupName, filterName, filterPattern string,
	transformations []MetricTransformation,
) error

PutMetricFilter creates or updates a metric filter for a log group.

func (*InMemoryBackend) PutQueryDefinition 

func (b *InMemoryBackend) PutQueryDefinition(
	name, queryString, queryDefinitionID string,
	logGroupNames []string,
) (string, error)

PutQueryDefinition creates or updates a query definition.

func (*InMemoryBackend) PutResourcePolicy 

func (b *InMemoryBackend) PutResourcePolicy(policyName, policyDocument string) (*ResourcePolicy, error)

PutResourcePolicy creates or updates a resource-based policy.

func (*InMemoryBackend) PutStorageTierPolicy added in v1.2.0 

func (b *InMemoryBackend) PutStorageTierPolicy(tier string) (*StorageTierPolicy, error)

PutStorageTierPolicy sets the account-level storage tier policy.

func (*InMemoryBackend) PutSubscriptionFilter 

func (b *InMemoryBackend) PutSubscriptionFilter(
	ctx context.Context,
	groupName, filterName, filterPattern, destinationArn, roleArn, distribution string,
) error

PutSubscriptionFilter creates or updates a subscription filter for a log group. roleArn is required by AWS when delivering to Kinesis streams; distribution defaults to Random.

func (*InMemoryBackend) PutSyslogConfiguration added in v1.2.0 

func (b *InMemoryBackend) PutSyslogConfiguration(
	ctx context.Context,
	logGroupIdentifier, vpcEndpointID string,
) (*SyslogConfiguration, error)

PutSyslogConfiguration creates or replaces the syslog configuration for a log group (see the SyslogConfiguration doc comment in models.go for the per-log-group-identifier keying rationale). Unlike the pre-existing IndexPolicy/Transformer completeness-pass ops, which accept any logGroupIdentifier string without checking it resolves to a real log group, this validates the log group actually exists in the caller's region and returns ResourceNotFoundException otherwise -- syslog ingestion cannot meaningfully attach to a log group that doesn't exist.

func (*InMemoryBackend) PutTransformer 

func (b *InMemoryBackend) PutTransformer(logGroupIdentifier string, processors []map[string]any) error

PutTransformer creates or updates a log transformer.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all in-memory state from the backend. It is used by the POST /_gopherstack/reset endpoint for CI pipelines and rapid local development.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) SetDeliveryTimeout 

func (b *InMemoryBackend) SetDeliveryTimeout(d time.Duration)

SetDeliveryTimeout overrides the per-delivery timeout applied to each subscription filter call. A zero value disables the timeout. Primarily intended for tests.

func (*InMemoryBackend) SetDeliveryWorkers 

func (b *InMemoryBackend) SetDeliveryWorkers(n int)

SetDeliveryWorkers overrides the maximum number of concurrent subscription delivery goroutines. Must be called before the first PutLogEvents. Primarily intended for tests.

func (*InMemoryBackend) SetExportSink 

func (b *InMemoryBackend) SetExportSink(sink ExportSink)

SetExportSink configures the S3 sink used to materialise export tasks. When a sink is set, CreateExportTask writes matching events to S3 and completes the task synchronously; without one, tasks advance by janitor age (legacy path).

func (*InMemoryBackend) SetLogGroupDeletionProtection 

func (b *InMemoryBackend) SetLogGroupDeletionProtection(logGroupIdentifier string, protected bool) error

SetLogGroupDeletionProtection enables or disables deletion protection for a log group.

func (*InMemoryBackend) SetMaxQueries 

func (b *InMemoryBackend) SetMaxQueries(n int)

SetMaxQueries overrides the maximum number of queries retained in memory. A value of zero disables the cap. Primarily intended for tests.

func (*InMemoryBackend) SetMetricEmitter 

func (b *InMemoryBackend) SetMetricEmitter(e MetricEmitter)

SetMetricEmitter sets the emitter used to forward metric filter matches to CloudWatch.

func (*InMemoryBackend) SetQueryStatusInternal 

func (b *InMemoryBackend) SetQueryStatusInternal(queryID string, status QueryStatus)

SetQueryStatusInternal sets the status of an existing query for testing. Used to place a query into Running or Scheduled state before calling StopQuery.

func (*InMemoryBackend) SetQueryTTL 

func (b *InMemoryBackend) SetQueryTTL(d time.Duration)

SetQueryTTL overrides the TTL used to evict queries by age. A value of zero disables TTL-based eviction. Primarily intended for tests.

func (*InMemoryBackend) SetRetentionPolicy 

func (b *InMemoryBackend) SetRetentionPolicy(
	ctx context.Context,
	groupName string,
	days *int32,
) error

SetRetentionPolicy sets or clears the retention policy for a log group. A nil days value removes any existing retention policy.

func (*InMemoryBackend) SetSettings 

func (b *InMemoryBackend) SetSettings(s Settings)

SetSettings updates the backend settings.

func (*InMemoryBackend) SetSubscriptionDeliverer 

func (b *InMemoryBackend) SetSubscriptionDeliverer(d SubscriptionDeliverer)

SetSubscriptionDeliverer sets the deliverer used to forward log events to subscription filter destinations.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

Ephemeral, never-persisted state is deliberately excluded, matching this backend's behavior before Phase 3.3: Insights query results/cache (b.queries, b.parsedQueries, b.ephemeralRegistry) and the compiled filter pattern cache (b.compiledPatterns) are not part of backendSnapshot.

func (*InMemoryBackend) StartQuery 

func (b *InMemoryBackend) StartQuery(
	ctx context.Context,
	queryID, queryString string,
	logGroupNames []string,
	startTime, endTime int64,
) (*QueryInfo, error)

StartQuery stores a new insights query and executes it immediately against in-memory events.

func (*InMemoryBackend) StopQuery 

func (b *InMemoryBackend) StopQuery(queryID string) error

StopQuery cancels a query that is currently running or scheduled. AWS returns InvalidOperationException when stopping a query that is not in a running state.

func (*InMemoryBackend) TestMetricFilter 

func (b *InMemoryBackend) TestMetricFilter(
	filterPattern string,
	logEventMessages []string,
) ([]MetricFilterMatchRecord, error)

TestMetricFilter tests a metric filter pattern against provided log event messages.

func (*InMemoryBackend) UpdateAnomaly 

func (b *InMemoryBackend) UpdateAnomaly(
	anomalyID, anomalyDetectorArn, suppressionType string,
) error

UpdateAnomaly updates the suppression state of a stored anomaly.

func (*InMemoryBackend) UpdateDeliveryConfiguration 

func (b *InMemoryBackend) UpdateDeliveryConfiguration(
	id, fieldDelimiter string,
	recordFields []string,
	s3Config *DeliveryS3Configuration,
) error

UpdateDeliveryConfiguration updates the field delimiter, record fields, and/or S3 delivery configuration for a delivery. s3Config matches real UpdateDeliveryConfigurationInput.S3DeliveryConfiguration (confirmed via api_op_UpdateDeliveryConfiguration.go) -- an earlier revision only updated fieldDelimiter/recordFields, silently dropping any S3DeliveryConfiguration a real client sent.

func (*InMemoryBackend) UpdateLogAnomalyDetector 

func (b *InMemoryBackend) UpdateLogAnomalyDetector(
	detectorArn, evaluationFrequency string,
	anomalyVisibilityTime int64,
	enabled bool,
) error

UpdateLogAnomalyDetector updates evaluation frequency and/or anomaly visibility time, and pauses or resumes the detector via enabled (aws-sdk-go-v2 UpdateLogAnomalyDetectorInput.Enabled -- a required field on the real API, used to pause/restart the detector; see types.AnomalyDetectorStatusPaused). enabled=false always sets the detector to PAUSED; enabled=true resumes a paused detector to ANALYZING and is a no-op on the status of a detector that isn't currently paused (e.g. still INITIALIZING).

func (*InMemoryBackend) UpdateLookupTable added in v1.2.0 

func (b *InMemoryBackend) UpdateLookupTable(
	lookupTableArn, tableBody string, description, kmsKeyID *string,
) (*LookupTable, error)

UpdateLookupTable replaces a lookup table's CSV content in full ("This is a full replacement operation."), optionally updating description/kmsKeyId when the caller supplies them (nil means leave unchanged, matching the real Input's *string/optional-pointer fields).

func (*InMemoryBackend) UpdateScheduledQuery 

func (b *InMemoryBackend) UpdateScheduledQuery(scheduledQueryArn, state string) error

UpdateScheduledQuery updates the state of a scheduled query.

func (*InMemoryBackend) ValidateLiveTailLogGroups 

func (b *InMemoryBackend) ValidateLiveTailLogGroups(
	ctx context.Context,
	logGroupIdentifiers []string,
) error

ValidateLiveTailLogGroups validates that every supplied log group identifier resolves to an existing log group. StartLiveTail is a streaming (HTTP/2 event-stream) operation that cannot be meaningfully emulated over the standard JSON response, so the backend only performs input validation and returns ResourceNotFoundException for any unknown log group.

type IndexPolicy 

type IndexPolicy struct {
	LastUpdated        time.Time `json:"lastUpdateTime"`
	LogGroupIdentifier string    `json:"logGroupIdentifier"`
	PolicyDocument     string    `json:"policyDocument"`
}

IndexPolicy represents a CloudWatch Logs field index policy.

type InputLogEvent 

type InputLogEvent struct {
	Message   string `json:"message"`
	Timestamp int64  `json:"timestamp"`
}

InputLogEvent represents a single log event for PutLogEvents.

type Janitor 

type Janitor struct {
	Backend     *InMemoryBackend
	Interval    time.Duration
	TaskTimeout time.Duration
}

Janitor is the CloudWatch Logs background worker that enforces retention policies by evicting log events that have aged past their log group's RetentionInDays setting.

func NewJanitor 

func NewJanitor(backend *InMemoryBackend, interval time.Duration) *Janitor

NewJanitor creates a new Janitor for the given backend. A zero interval falls back to the default of one minute.

func (*Janitor) Run 

func (j *Janitor) Run(ctx context.Context)

Run runs the janitor loop until ctx is cancelled.

func (*Janitor) SweepOnce 

func (j *Janitor) SweepOnce(ctx context.Context)

SweepOnce runs a single retention sweep. Primarily intended for tests.

type LogAnomalyDetector 

type LogAnomalyDetector struct {
	AnomalyDetectorArn    string   `json:"anomalyDetectorArn"`
	DetectorName          string   `json:"detectorName,omitempty"`
	AnomalyDetectorStatus string   `json:"anomalyDetectorStatus,omitempty"`
	EvaluationFrequency   string   `json:"evaluationFrequency,omitempty"`
	FilterPattern         string   `json:"filterPattern,omitempty"`
	KmsKeyID              string   `json:"kmsKeyId,omitempty"`
	LogGroupArnList       []string `json:"logGroupArnList"`
	AnomalyVisibilityTime int64    `json:"anomalyVisibilityTime,omitempty"`
	CreationTimeStamp     int64    `json:"creationTimeStamp"`
	LastModifiedTimeStamp int64    `json:"lastModifiedTimeStamp,omitempty"`
}

LogAnomalyDetector represents a CloudWatch Logs anomaly detector. LogAnomalyDetector represents a CloudWatch Logs log anomaly detector. Field-diffed against aws-sdk-go-v2 types.AnomalyDetector / GetLogAnomalyDetectorOutput: the status wire key is anomalyDetectorStatus, not detectorStatus (a previous version of this struct used the wrong key, so a real SDK client would always see an empty/unknown status). evaluationLookback and filterAnomalies were also removed here: neither exists anywhere in the real SDK (types package, any api_op_*.go input, or any doc comment) -- they were invented fields with no wire representation, never read anywhere in this codebase either (grep found only their own declaration), so they were dead weight rather than a real gap.

type LogGroup 

type LogGroup struct {
	RetentionInDays *int32 `json:"retentionInDays,omitempty"`
	LogGroupName    string `json:"logGroupName"`
	Arn             string `json:"arn"`
	LogGroupClass   string `json:"logGroupClass,omitempty"`
	KmsKeyID        string `json:"kmsKeyId,omitempty"`

	CreationTime      int64 `json:"creationTime"`
	StoredBytes       int64 `json:"storedBytes"`
	MetricFilterCount int32 `json:"metricFilterCount"`
	// contains filtered or unexported fields
}

LogGroup represents a CloudWatch Logs log group.

type LogGroupField 

type LogGroupField struct {
	Name    string `json:"name"`
	Percent int32  `json:"percent"`
}

LogGroupField is a field name and estimated percentage of log events that contain the field.

type LogStream 

type LogStream struct {
	FirstEventTimestamp *int64 `json:"firstEventTimestamp,omitempty"`
	LastEventTimestamp  *int64 `json:"lastEventTimestamp,omitempty"`
	LastIngestionTime   *int64 `json:"lastIngestionTime,omitempty"`
	LogStreamName       string `json:"logStreamName"`
	Arn                 string `json:"arn"`
	UploadSequenceToken string `json:"uploadSequenceToken"`

	CreationTime int64 `json:"creationTime"`
	StoredBytes  int64 `json:"storedBytes"`
	// contains filtered or unexported fields
}

LogStream represents a CloudWatch Logs log stream.

type LookupTable added in v1.2.0 

type LookupTable struct {
	LookupTableArn  string   `json:"lookupTableArn"`
	LookupTableName string   `json:"lookupTableName"`
	Description     string   `json:"description,omitempty"`
	KmsKeyID        string   `json:"kmsKeyId,omitempty"`
	TableBody       string   `json:"tableBody"`
	TableFields     []string `json:"tableFields"`
	RecordsCount    int64    `json:"recordsCount"`
	SizeBytes       int64    `json:"sizeBytes"`
	CreatedAt       int64    `json:"createdAt"`
	LastUpdatedTime int64    `json:"lastUpdatedTime"`
}

LookupTable represents a CloudWatch Logs lookup table. Field-diffed against aws-sdk-go-v2 types.LookupTable (the metadata shape returned by DescribeLookupTables) and GetLookupTableOutput (the full-content shape, which additionally carries TableBody). Unlike several other CloudWatch Logs "ingest from elsewhere" resources, CreateLookupTable's CSV content (TableBody) is supplied directly in the request body -- there is no S3 reference anywhere in this operation's real input/output shape (CreateLookupTableInput.TableBody and UpdateLookupTableInput.TableBody are both a plain *string of CSV text, verified against the real SDK's serializers.go) -- so this backend stores and parses the real CSV content (see lookup_tables.go's parseLookupTableCSV) rather than modeling a reference to data it never actually reads.

type MetricEmitter 

type MetricEmitter interface {
	// EmitMetric records a single metric data point with the given namespace, name, value, and unit.
	EmitMetric(namespace, name string, value float64, unit string) error
}

MetricEmitter emits a CloudWatch metric data point. It is implemented by the CloudWatch backend and injected into InMemoryBackend so that metric filter matches on PutLogEvents can be forwarded to CloudWatch.

type MetricEmitterFunc 

type MetricEmitterFunc func(namespace, name string, value float64, unit string) error

MetricEmitterFunc is a function adapter for MetricEmitter.

func (MetricEmitterFunc) EmitMetric 

func (f MetricEmitterFunc) EmitMetric(namespace, name string, value float64, unit string) error

EmitMetric implements MetricEmitter.

type MetricFilter 

type MetricFilter struct {
	RetentionInDays *int32 `json:"retentionInDays,omitempty"`
	FilterPattern   string `json:"filterPattern"`
	FilterName      string `json:"filterName"`
	LogGroupName    string `json:"logGroupName"`

	MetricTransformations []MetricTransformation `json:"metricTransformations"`
	CreationTime          int64                  `json:"creationTime"`
	// contains filtered or unexported fields
}

MetricFilter represents a CloudWatch Logs metric filter.

type MetricFilterMatchRecord 

type MetricFilterMatchRecord struct {
	ExtractedValues map[string]string `json:"extractedValues"`
	EventMessage    string            `json:"eventMessage"`
	EventNumber     int64             `json:"eventNumber"`
}

MetricFilterMatchRecord represents one event that matched a TestMetricFilter call.

type MetricTransformation 

type MetricTransformation struct {
	Dimensions      map[string]string `json:"dimensions,omitempty"`
	DefaultValue    *float64          `json:"defaultValue,omitempty"`
	MetricNamespace string            `json:"metricNamespace"`
	MetricName      string            `json:"metricName"`
	MetricValue     string            `json:"metricValue"`
	Unit            string            `json:"unit,omitempty"`
}

MetricTransformation describes how to extract a metric from a log event.

type OutputLogEvent 

type OutputLogEvent struct {
	Message       string `json:"message"`
	Ptr           string `json:"ptr,omitempty"`
	IngestionTime int64  `json:"ingestionTime"`
	Timestamp     int64  `json:"timestamp"`
}

OutputLogEvent represents a single log event returned by GetLogEvents.

type Provider 

type Provider struct{}

Provider implements service.Provider for the CloudWatch Logs service.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the CloudWatch Logs service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the logical name of the provider.

type PutLogEventsResult 

type PutLogEventsResult struct {
	RejectedLogEventsInfo *RejectedLogEventsInfo `json:"rejectedLogEventsInfo,omitempty"`
	NextSequenceToken     string                 `json:"nextSequenceToken"`
}

PutLogEventsResult is the result of a PutLogEvents call.

type QueryDefinition 

type QueryDefinition struct {
	QueryDefinitionID string   `json:"queryDefinitionId"`
	Name              string   `json:"name"`
	QueryString       string   `json:"queryString"`
	LogGroupNames     []string `json:"logGroupNames,omitempty"`
	LastModified      int64    `json:"lastModified"`
}

QueryDefinition represents a saved CloudWatch Logs Insights query definition.

type QueryInfo 

type QueryInfo struct {
	QueryID      string      `json:"queryId"`
	QueryString  string      `json:"queryString"`
	LogGroupName string      `json:"logGroupName,omitempty"`
	Status       QueryStatus `json:"status"`
	CreateTime   int64       `json:"createTime"`
}

QueryInfo contains metadata about a Logs Insights query.

type QueryStatistics 

type QueryStatistics struct {
	BytesScanned   float64 `json:"bytesScanned"`
	RecordsMatched float64 `json:"recordsMatched"`
	RecordsScanned float64 `json:"recordsScanned"`
}

QueryStatistics contains execution statistics for a Logs Insights query.

type QueryStatus 

type QueryStatus string

QueryStatus represents the lifecycle status of a Logs Insights query. 

const (
	QueryStatusScheduled QueryStatus = "Scheduled"
	QueryStatusRunning   QueryStatus = "Running"
	QueryStatusComplete  QueryStatus = "Complete"
	QueryStatusFailed    QueryStatus = "Failed"
	QueryStatusCancelled QueryStatus = "Cancelled"
)

type RejectedLogEventsInfo 

type RejectedLogEventsInfo struct {
	TooNewLogEventStartIndex *int32 `json:"tooNewLogEventStartIndex,omitempty"`
	TooOldLogEventEndIndex   *int32 `json:"tooOldLogEventEndIndex,omitempty"`
	ExpiredLogEventEndIndex  *int32 `json:"expiredLogEventEndIndex,omitempty"`
}

RejectedLogEventsInfo describes log events that were rejected by PutLogEvents. Field names/wire keys match aws-sdk-go-v2 types.RejectedLogEventsInfo exactly: TooOldLogEventEndIndex (not "...StartIndex") is the exclusive end index of the too-old run, mirroring ExpiredLogEventEndIndex's exclusive-end semantics.

type ResourcePolicy 

type ResourcePolicy struct {
	LastUpdated    time.Time `json:"-"`
	PolicyName     string    `json:"policyName"`
	PolicyDocument string    `json:"policyDocument"`
}

ResourcePolicy represents a CloudWatch Logs resource policy.

type ResultField 

type ResultField struct {
	Field string `json:"field"`
	Value string `json:"value"`
}

ResultField is a single field in a Logs Insights result row.

type ScheduledQuery 

type ScheduledQuery struct {
	DestinationConfiguration *ScheduledQueryDestinationConfig `json:"destinationConfiguration,omitempty"`
	ScheduleExpression       string                           `json:"scheduleExpression,omitempty"`
	QueryString              string                           `json:"queryString"`
	State                    string                           `json:"state"`
	Name                     string                           `json:"name"`
	Timezone                 string                           `json:"timezone,omitempty"`
	LastExecutionStatus      string                           `json:"lastExecutionStatus,omitempty"`
	ScheduleType             string                           `json:"scheduleType,omitempty"`
	ScheduledQueryArn        string                           `json:"scheduledQueryArn"`
	QueryLanguage            string                           `json:"queryLanguage,omitempty"`
	Description              string                           `json:"description,omitempty"`
	ExecutionRoleArn         string                           `json:"executionRoleArn,omitempty"`
	LogGroupIdentifiers      []string                         `json:"logGroupIdentifiers,omitempty"`
	ScheduleEndTime          int64                            `json:"scheduleEndTime,omitempty"`
	LastUpdatedTime          int64                            `json:"lastUpdatedTime,omitempty"`
	CreationTime             int64                            `json:"creationTime"`
	LastTriggeredTime        int64                            `json:"lastTriggeredTime,omitempty"`
	StartTimeOffset          int64                            `json:"startTimeOffset,omitempty"`
	EndTimeOffset            int64                            `json:"endTimeOffset,omitempty"`
	ScheduleStartTime        int64                            `json:"scheduleStartTime,omitempty"`
}

ScheduledQuery represents a CloudWatch Logs scheduled query, field-diffed against GetScheduledQueryOutput (confirmed via api_op_GetScheduledQuery.go and its deserializer). The wire key for the identifying ARN is scheduledQueryArn, not arn -- a previous version of this struct used the wrong key, so a real SDK client's ScheduledQueryArn field would always deserialize empty. A previous version also modeled only 6 of GetScheduledQueryOutput's ~20 members; this now covers the full set. ScheduleType is not client-settable (CreateScheduledQueryInput/ UpdateScheduledQueryInput have no scheduleType member) -- every backend-created query is CUSTOMER_MANAGED, since AWS_MANAGED queries are pre-provisioned by AWS itself, not created through this API.

type ScheduledQueryCreateParams added in v1.2.0 

type ScheduledQueryCreateParams struct {
	DestinationConfiguration *ScheduledQueryDestinationConfig
	ScheduleExpression       string
	QueryLanguage            string
	Name                     string
	ExecutionRoleArn         string
	State                    string
	Description              string
	Timezone                 string
	QueryString              string
	LogGroupIdentifiers      []string
	EndTimeOffset            int64
	StartTimeOffset          int64
	ScheduleStartTime        int64
	ScheduleEndTime          int64
}

ScheduledQueryCreateParams bundles CreateScheduledQuery's real-API request fields (field-diffed against CreateScheduledQueryInput) to avoid an unwieldy positional parameter list. Name/QueryString/QueryLanguage/ ScheduleExpression/ExecutionRoleArn are required, matching the real input's "This member is required" members; State defaults to ENABLED when empty, also matching the real default.

type ScheduledQueryDestinationConfig added in v1.2.0 

type ScheduledQueryDestinationConfig struct {
	S3Configuration *ScheduledQueryS3Configuration `json:"s3Configuration,omitempty"`
}

ScheduledQueryDestinationConfig mirrors the real DestinationConfiguration shape (aws-sdk-go-v2 types.DestinationConfiguration): currently only an S3 destination is modeled by the real API.

type ScheduledQueryRunSummary 

type ScheduledQueryRunSummary struct {
	Arn            string `json:"arn"`
	FailureReason  string `json:"failureReason,omitempty"`
	RunStatus      string `json:"runStatus"`
	ExecutionTime  int64  `json:"executionTime"`
	InvocationTime int64  `json:"invocationTime"`
}

ScheduledQueryRunSummary describes a single scheduled query execution.

type ScheduledQueryS3Configuration added in v1.2.0 

type ScheduledQueryS3Configuration struct {
	DestinationIdentifier string `json:"destinationIdentifier"`
	RoleArn               string `json:"roleArn"`
	KmsKeyID              string `json:"kmsKeyId,omitempty"`
	OwnerAccountID        string `json:"ownerAccountId,omitempty"`
}

ScheduledQueryS3Configuration mirrors the real S3Configuration shape used by ScheduledQueryDestinationConfig.

type SearchedLogStream 

type SearchedLogStream struct {
	LogStreamName      string `json:"logStreamName"`
	SearchedCompletely bool   `json:"searchedCompletely"`
}

SearchedLogStream indicates whether a log stream was searched completely by FilterLogEvents. AWS deprecated populating this list (it returns empty) but the field remains part of the response shape.

type Settings 

type Settings struct {
	JanitorInterval  time.Duration `json:"janitor_interval"   env:"CLOUDWATCHLOGS_JANITOR_INTERVAL"   default:"1m" help:"Janitor tick interval."` //nolint:lll // long struct tags
	MaxRetentionDays int           ``                                                                                                             //nolint:lll // long struct tags
	/* 158-byte string literal not displayed */
}

Settings holds service-level configuration for the CloudWatch Logs backend. Fields are picked up by the Kong CLI parser when this struct is embedded in the root CLI command.

type StorageBackend 

type StorageBackend interface {
	CreateLogGroup(ctx context.Context, name, logGroupClass, kmsKeyID string) (*LogGroup, error)
	DeleteLogGroup(ctx context.Context, name string) error
	DescribeLogGroups(
		ctx context.Context,
		prefix, nextToken string,
		limit int,
	) ([]LogGroup, string, error)
	CreateLogStream(ctx context.Context, groupName, streamName string) (*LogStream, error)
	DeleteLogStream(ctx context.Context, groupName, streamName string) error
	DescribeLogStreams(
		ctx context.Context,
		groupName, prefix, nextToken, orderBy string,
		descending bool,
		limit int,
	) ([]LogStream, string, error)
	PutLogEvents(
		ctx context.Context, groupName, streamName, sequenceToken string, events []InputLogEvent,
	) (*PutLogEventsResult, error)
	GetLogEvents(
		ctx context.Context,
		groupName, streamName string,
		startTime, endTime *int64,
		limit int,
		nextToken string,
		startFromHead bool,
	) (
		[]OutputLogEvent, string, string, error)
	FilterLogEvents(ctx context.Context, p FilterLogEventsParams) (
		[]FilteredLogEvent, string, []SearchedLogStream, error)
	PutSubscriptionFilter(
		ctx context.Context, groupName, filterName, filterPattern, destinationArn, roleArn, distribution string,
	) error
	DescribeSubscriptionFilters(
		ctx context.Context,
		groupName, filterNamePrefix, nextToken string,
		limit int,
	) (
		[]SubscriptionFilter, string, error)
	DeleteSubscriptionFilter(ctx context.Context, groupName, filterName string) error
	SetRetentionPolicy(ctx context.Context, groupName string, days *int32) error
	StartQuery(
		ctx context.Context, queryID, queryString string, logGroupNames []string, startTime, endTime int64,
	) (*QueryInfo, error)
	GetQueryResults(queryID string) ([][]ResultField, QueryStatistics, QueryStatus, error)
	StopQuery(queryID string) error
	DescribeQueries(
		logGroupName, statusFilter, nextToken string,
		maxResults int,
	) ([]QueryInfo, string, error)

	// AssociateKmsKey associates a KMS key with a log group or query results resource.
	AssociateKmsKey(logGroupName, resourceIdentifier, kmsKeyID string) error
	// AssociateSourceToS3TableIntegration associates a data source with an S3 table integration.
	AssociateSourceToS3TableIntegration(
		integrationArn, dataSourceName, dataSourceType string,
	) (string, error)
	// CancelExportTask cancels a pending or running export task.
	CancelExportTask(taskID string) error
	// CancelImportTask cancels a running import task.
	CancelImportTask(importID string) (*ImportTask, error)
	// CreateDelivery creates a delivery between a delivery source and destination.
	CreateDelivery(
		deliverySourceName, deliveryDestinationArn, fieldDelimiter string,
		recordFields []string,
		s3Config *DeliveryS3Configuration,
		tags map[string]string,
	) (*Delivery, error)
	// CreateExportTask creates an asynchronous export task to S3.
	CreateExportTask(
		taskName, logGroupName, logStreamNamePrefix, destination, destinationPrefix string,
		from, to int64,
	) (string, error)
	// CreateImportTask creates an import task from a CloudTrail Lake event data store.
	CreateImportTask(importRoleArn, importSourceArn string) (*ImportTask, error)
	// CreateLogAnomalyDetector creates an anomaly detector for one or more log groups.
	CreateLogAnomalyDetector(
		logGroupArnList []string,
		detectorName, evaluationFrequency, filterPattern, kmsKeyID string,
		anomalyVisibilityTime int64,
	) (string, error)
	// CreateScheduledQuery creates a scheduled CloudWatch Logs Insights query.
	CreateScheduledQuery(p ScheduledQueryCreateParams) (string, error)
	// DeleteAccountPolicy deletes a CloudWatch Logs account-level policy.
	DeleteAccountPolicy(policyName, policyType string) error
	// DescribeExportTasks lists export tasks optionally filtered by task ID or status.
	DescribeExportTasks(
		taskID, statusCode string,
		limit int,
		nextToken string,
	) ([]ExportTask, string, error)
	// DescribeImportTasks lists import tasks optionally filtered by task ID.
	DescribeImportTasks(taskID string, limit int, nextToken string) ([]ImportTask, string, error)
	// DescribeDeliveries lists deliveries with pagination.
	DescribeDeliveries(limit int, nextToken string) ([]Delivery, string, error)
	// GetDelivery returns a single delivery by ID.
	GetDelivery(id string) (*Delivery, error)
	// DeleteDelivery deletes a delivery by ID.
	DeleteDelivery(id string) error
	// DeleteLogAnomalyDetector deletes a log anomaly detector.
	DeleteLogAnomalyDetector(detectorArn string) error
	// ListLogAnomalyDetectors lists anomaly detectors, optionally filtered by log group ARN.
	ListLogAnomalyDetectors(
		filterLogGroupArnList []string,
		limit int,
		nextToken string,
	) ([]LogAnomalyDetector, string, error)
	// UpdateLogAnomalyDetector updates evaluation frequency and/or anomaly
	// visibility time, and pauses/resumes the detector via enabled.
	UpdateLogAnomalyDetector(
		detectorArn, evaluationFrequency string,
		anomalyVisibilityTime int64,
		enabled bool,
	) error
	// DeleteScheduledQuery deletes a scheduled query by ARN.
	DeleteScheduledQuery(scheduledQueryArn string) error
	// ListScheduledQueries lists all scheduled queries with pagination.
	ListScheduledQueries(limit int, nextToken string) ([]ScheduledQuery, string, error)
	// UpdateScheduledQuery updates the state of a scheduled query.
	UpdateScheduledQuery(scheduledQueryArn, state string) error
	// PutAccountPolicy creates or updates an account-level policy.
	PutAccountPolicy(
		policyName, policyType, policyDocument, scope, selectionCriteria string,
	) (*AccountPolicy, error)
	// DescribeAccountPolicies returns account-level policies, optionally filtered.
	DescribeAccountPolicies(
		policyType, policyName string,
		accountIdentifiers []string,
		limit int,
		nextToken string,
	) ([]AccountPolicy, string, error)
	// DisassociateKmsKey removes the KMS key association from a log group or resource.
	DisassociateKmsKey(logGroupName, resourceIdentifier string) error
	// PutMetricFilter creates or updates a metric filter for a log group.
	PutMetricFilter(
		ctx context.Context, logGroupName, filterName, filterPattern string, transformations []MetricTransformation,
	) error
	// DescribeMetricFilters lists metric filters with optional filters.
	DescribeMetricFilters(
		ctx context.Context,
		logGroupName, filterNamePrefix, metricName, metricNamespace, nextToken string,
		limit int,
	) ([]MetricFilter, string, error)
	// DeleteMetricFilter deletes a metric filter from a log group.
	DeleteMetricFilter(ctx context.Context, logGroupName, filterName string) error
	// TestMetricFilter tests a metric filter pattern against provided log event messages.
	TestMetricFilter(
		filterPattern string,
		logEventMessages []string,
	) ([]MetricFilterMatchRecord, error)
	// PutQueryDefinition creates or updates a query definition.
	PutQueryDefinition(
		name, queryString, queryDefinitionID string,
		logGroupNames []string,
	) (string, error)
	// DescribeQueryDefinitions lists query definitions optionally filtered by name prefix.
	DescribeQueryDefinitions(
		queryDefinitionNamePrefix string,
		limit int,
		nextToken string,
	) ([]QueryDefinition, string, error)
	// DeleteQueryDefinition deletes a query definition by ID.
	DeleteQueryDefinition(queryDefinitionID string) error
	// GetLogAnomalyDetector returns the anomaly detector with the given ARN.
	GetLogAnomalyDetector(detectorArn string) (*LogAnomalyDetector, error)
	// GetScheduledQuery returns the scheduled query with the given ARN.
	GetScheduledQuery(scheduledQueryArn string) (*ScheduledQuery, error)
	// GetLogGroupFields returns the fields discovered in log events sampled from
	// the log group, each with the percentage of sampled events that contained
	// it. timeSec (epoch seconds), when non-nil, centers an 8-minutes-either-side
	// sampling window; when nil, the most recent 15 minutes up to now is sampled.
	GetLogGroupFields(ctx context.Context, logGroupName string, timeSec *int64) ([]LogGroupField, error)
	// GetLogRecord returns a single log event by its log record pointer.
	GetLogRecord(ctx context.Context, logRecordPointer string) (map[string]string, error)
	// ListAnomalies lists anomalies for the given anomaly detector ARN with pagination.
	ListAnomalies(anomalyDetectorArn string, limit int, nextToken string) ([]Anomaly, string, error)
	// ListLogGroupsForQuery returns the log group names used in a specific query.
	ListLogGroupsForQuery(queryID string) ([]string, error)
	// GetScheduledQueryHistory returns the execution history for a scheduled query.
	GetScheduledQueryHistory(
		scheduledQueryArn string,
		nextToken string,
		maxResults int,
	) ([]ScheduledQueryRunSummary, string, error)
	// UpdateAnomaly updates anomaly suppression settings. No actual anomaly data is stored.
	UpdateAnomaly(anomalyID, anomalyDetectorArn string, suppressionType string) error
	// ListLogGroups is the newer paginated list operation, equivalent to DescribeLogGroups.
	ListLogGroups(
		ctx context.Context,
		namePrefix, nextToken string,
		limit int,
	) ([]LogGroup, string, error)
}

StorageBackend is the interface for a CloudWatch Logs in-memory store.

type StorageTierPolicy added in v1.2.0 

type StorageTierPolicy struct {
	StorageTier     string `json:"storageTier"`
	LastUpdatedTime int64  `json:"lastUpdatedTime,omitempty"`
}

StorageTierPolicy represents the account-level CloudWatch Logs storage tier policy. Field-diffed against aws-sdk-go-v2 GetStorageTierPolicyOutput/PutStorageTierPolicyOutput: both are account-scoped, not per-log-group -- GetStorageTierPolicyInput carries no fields at all, and PutStorageTierPolicyInput carries only StorageTier (no LogGroupIdentifier) -- so this is a singleton, not attached to any individual log group. It is a related-but-distinct axis from LogGroup's existing LogGroupClass (STANDARD/INFREQUENT_ACCESS, set per log group at CreateLogGroup time, gating feature availability): StorageTier (STANDARD/INTELLIGENT_TIERING) instead governs whether CloudWatch Logs automatically moves already-ingested data between storage tiers account-wide over time to optimize cost. Nothing in the real API wires the two together (GetStorageTierPolicyOutput carries no log-group-class information and LogGroup carries no storage-tier information), so this backend keeps them as two independent concepts rather than inventing a dependency between them.

type SubscriptionDeliverer 

type SubscriptionDeliverer interface {
	// DeliverLogEvents delivers a gzipped, base64-encoded CloudWatch Logs payload to destinationArn.
	DeliverLogEvents(ctx context.Context, destinationArn string, payload []byte) error
}

SubscriptionDeliverer delivers encoded log event payloads to a subscription filter destination.

type SubscriptionDelivererFunc 

type SubscriptionDelivererFunc func(ctx context.Context, destinationArn string, payload []byte) error

SubscriptionDelivererFunc is a function adapter for SubscriptionDeliverer.

func (SubscriptionDelivererFunc) DeliverLogEvents 

func (f SubscriptionDelivererFunc) DeliverLogEvents(
	ctx context.Context,
	destinationArn string,
	payload []byte,
) error

DeliverLogEvents implements SubscriptionDeliverer.

type SubscriptionFilter 

type SubscriptionFilter struct {
	FilterPattern  string `json:"filterPattern"`
	FilterName     string `json:"filterName"`
	LogGroupName   string `json:"logGroupName"`
	DestinationArn string `json:"destinationArn"`
	RoleArn        string `json:"roleArn,omitempty"`
	Distribution   string `json:"distribution,omitempty"`

	CreationTime int64 `json:"creationTime"`
	// contains filtered or unexported fields
}

SubscriptionFilter represents a CloudWatch Logs subscription filter.

type SyslogConfiguration added in v1.2.0 

type SyslogConfiguration struct {
	LogGroupIdentifier string `json:"logGroupIdentifier"`
	LogGroupArn        string `json:"logGroupArn"`
	SourceType         string `json:"sourceType"`
	VpcEndpointID      string `json:"vpcEndpointId,omitempty"`
	CreatedAt          int64  `json:"createdAt"`
}

SyslogConfiguration represents a CloudWatch Logs syslog ingestion configuration for a log group. Field-diffed against aws-sdk-go-v2 types.SyslogConfiguration (createdAt/logGroupArn/sourceType/vpcEndpointId). PutSyslogConfigurationInput/DeleteSyslogConfigurationInput both require LogGroupIdentifier but only optionally accept VpcEndpointId, so this backend models at most one syslog configuration per log group (Put replaces), matching the per-log-group-identifier keying this codebase already uses for IndexPolicy/Transformer (see indexPolicyKeyFn/ transformerKeyFn in store_setup.go).

type TaggedEntry added in v1.2.0 

type TaggedEntry struct {
	Tags map[string]string
	ARN  string
}

TaggedEntry pairs a resource ARN with its tag map, for cross-service tag enumeration by the Resource Groups Tagging API (see cli.go's wireTaggingCloudWatchLogs).

type TestTransformerOutput 

type TestTransformerOutput struct {
	EventMessage            string `json:"eventMessage"`
	TransformedEventMessage string `json:"transformedEventMessage"`
	EventNumber             int64  `json:"eventNumber"`
}

TestTransformerOutput is a single transformed log event result. It mirrors the AWS TransformedLogRecord shape, carrying both the original and transformed message plus the 1-based event number.

func ApplyTransformer 

func ApplyTransformer(
	messages []string,
	processors []map[string]any,
) []TestTransformerOutput

ApplyTransformer applies the supplied transformer processors to the supplied sample log event messages and returns the transformed results. The transform is deterministic: processors are applied in order to each event. Supported processors mirror a useful subset of the AWS transformer grammar:

  • addKeys: add fixed key/value entries to the (JSON) event
  • deleteKeys: remove keys from the (JSON) event
  • renameKeys: rename keys within the (JSON) event
  • lowerCaseString / upperCaseString: case-fold named string fields
  • copyValue: copy one field's value into another

Events that are not JSON objects are passed through unchanged for JSON-oriented processors. Unknown processors are ignored.

type Transformer 

type Transformer struct {
	CreatedAt          time.Time        `json:"-"`
	LogGroupIdentifier string           `json:"logGroupIdentifier"`
	Processors         []map[string]any `json:"transformerConfig"`
}

Transformer represents a CloudWatch Logs log transformer.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.