View a markdown version of this page

sessionize - Amazon CloudWatch Logs
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

sessionize

Use the sessionize command to group events into sessions by identity fields and an inactivity gap. The command emits a session identifier field.

Syntax

| sessionize field[, field ...] [maxspan duration] [AS out]

The command uses the following arguments:

  • field – One or more identity fields to group by.

  • maxspan duration (Optional) – The maximum inactivity gap before starting a new session. Default: 30m.

  • AS out (Optional) – The output field name. Default: session_id.

Example

The following query groups events into sessions by user and device with a 1-hour inactivity gap.

fields @timestamp, userId, deviceId
| sessionize userId, deviceId maxspan 1h as my_session