Updating a scheduled query - Amazon CloudWatch Logs
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Updating a scheduled query

Modify your scheduled query configuration to change the query string, schedule, destinations, or execution role as your requirements evolve.

You can update any aspect of a scheduled query, including the query string, schedule expression, destinations, and execution role. Changes take effect immediately for future executions.

Console
To update a scheduled query (console)

  1. In the CloudWatch Logs console, choose Scheduled query, View scheduled queries.

  2. Select the scheduled query you want to update.

  3. Choose Edit.

  4. Modify the configuration as needed.

  5. Choose Save changes.

Amazon CLI
To update a scheduled query (Amazon CLI)

  • Use the update-scheduled-query command to modify an existing scheduled query:

    aws logs update-scheduled-query \
    --identifier "arn:aws:logs:us-east-1:111122223333:scheduled-query:5e0c0228-1c29-4d26-904f-59f1f1ba3c8f" \
    --description "Monitor for ERROR level logs daily" \
    --query-language "LogsQL" \
    --query-string "fields @timestamp, @message | filter @message like /ERROR/" \
    --log-group-identifiers "/aws/lambda/my-function-1" "/aws/lambda/my-function-2"
API
To update a scheduled query (API)

  1. Use the UpdateScheduledQuery action to modify scheduled query configuration:

    {
    "identifier": "arn:aws:logs:us-east-1:111122223333:scheduled-query:5e0c0228-1c29-4d26-904f-59f1f1ba3c8f",
    "queryString": "fields @timestamp, @message | filter @message like /WARNING|ERROR/ | stats count() by bin(5m)",
    "scheduleExpression": "cron(0 */2 * * ? *)",
    "state": "ENABLED"
}

  2. To update multiple configuration parameters at once:

    {
    "identifier": "arn:aws:logs:us-east-1:111122223333:scheduled-query:5e0c0228-1c29-4d26-904f-59f1f1ba3c8f",
    "queryString": "fields @timestamp, @message, @level | filter @level = 'ERROR'",
    "scheduleExpression": "cron(0 8,12,16 * * ? *)",
    "executionRoleArn": "arn:aws:iam::111122223333:role/UpdatedScheduledQueryRole",
    "logGroupIdentifiers": ["/aws/lambda/my-function", "/aws/lambda/another-function"],
    "destinationConfiguration": {
        "s3Configuration": {
            "destinationIdentifier": "s3://111122223333-sqn-results-bucket/processed-results",
            "roleArn": "arn:aws:iam::111122223333:role/Admin"
        }
    }
}