aws-sdk-cloudwatchlogs 1.159.0 → 1.161.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: af1c399693416da43f0f382a0b49226a8cdd29e3c353ff785351de4694a9772c
-  data.tar.gz: 778f8b47f3f8b4c1bed88ba71610a99b11a55e48fe9fded4fbbd20dc01de5ee2
+  metadata.gz: b118398e5d33e503c30e524c9c9927dba433b6f4fbb4697795509d3eaadd7a72
+  data.tar.gz: 36d9a27673094a461fd06a45da01f0afb6dda78b9cad014f17f8b29eae61d1b2
 SHA512:
-  metadata.gz: dabca0581f2fb9089d203d8fa71f48fc5a4b704ba8ff3cd04e12d98a2aa3d91071af9a82e91cdd438a89fcca849f5903eb1d86b7ca5a1b028358c7c6724c4324
-  data.tar.gz: bab2bd952d6e80558df8d9b00118e901ca3590a8a2a85b43a7e7d1cc7fd30a6a708ce7dd5543c94b60fb0ae54cb66f4f27861a5dc10b36dd81a32d33007b5dd9
+  metadata.gz: 1602fe95620c8185927a4ab82f49a5a24c1327163b8d2c96c0202238e2953f77305615508bfb2ec37210697c765fe77236d9b2e61ed7e1f646c710cd2c0a29ea
+  data.tar.gz: c4d4577f0819389f4eea7c78e78b41418ff5ca547a0d191b9be913d367ab4c49a75dae724d104d9ce0702c5154bb21708ea5063382226b1120c8dd00a46862ee

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.161.0 (2026-08-06)
+------------------
+
+* Feature - This release adds index category support to the CloudWatch Logs DescribeFieldIndexes API. Customers can filter and identify DEFAULT, CUSTOM, AUTO, and INACTIVE field indexes.
+
+1.160.0 (2026-07-31)
+------------------
+
+* Feature - Amazon CloudWatch Logs now lets you create and update lookup tables directly from CloudWatch Logs query results by passing a queryId, and configure a lookup table as a scheduled query destination so it refreshes automatically with the latest query results on each run.
+
 1.159.0 (2026-07-09)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.159.0
+1.161.0

data/lib/aws-sdk-cloudwatchlogs/client.rb

@@ -1344,14 +1344,15 @@ module Aws::CloudWatchLogs
       req.send_request(options)
     end
 
-    # Creates a lookup table by uploading CSV data. You can use lookup
-    # tables to enrich log data in CloudWatch Logs Insights queries with
-    # reference data such as user details, application names, or error
-    # descriptions.
+    # Creates a lookup table by uploading CSV data or from CloudWatch Logs
+    # query results. You can use lookup tables to enrich log data in
+    # CloudWatch Logs queries with reference data such as user details,
+    # application names, or error descriptions.
     #
-    # The table name must be unique within your account and Region. The CSV
-    # content must include a header row with column names, use UTF-8
-    # encoding, and not exceed 10 MB.
+    # The table name must be unique within your account and Region. You must
+    # specify either `tableBody` or `queryId`, but not both. If you use
+    # `tableBody`, the CSV content must include a header row with column
+    # names, use UTF-8 encoding, and not exceed 10 MB.
     #
     # @option params [required, String] :lookup_table_name
     #   The name of the lookup table. The name must be unique within your
@@ -1362,11 +1363,20 @@ module Aws::CloudWatchLogs
     #   A description of the lookup table. The description can be up to 1024
     #   characters long.
     #
-    # @option params [required, String] :table_body
+    # @option params [String] :table_body
     #   The CSV content of the lookup table. The first row must be a header
     #   row with column names. The content must use UTF-8 encoding and not
     #   exceed 10 MB.
     #
+    #   You must specify either `tableBody` or `queryId`, but not both.
+    #
+    # @option params [String] :query_id
+    #   The ID of a completed or cancelled CloudWatch Logs query whose results
+    #   populate the lookup table. A cancelled query populates the table with
+    #   the partial results that were available when the query was stopped.
+    #
+    #   You must specify either `tableBody` or `queryId`, but not both.
+    #
     # @option params [String] :kms_key_id
     #   The ARN of the KMS key to use to encrypt the lookup table data. If you
     #   don't specify a key, the data is encrypted with an Amazon Web
@@ -1387,7 +1397,8 @@ module Aws::CloudWatchLogs
     #   resp = client.create_lookup_table({
     #     lookup_table_name: "LookupTableName", # required
     #     description: "LookupTableDescription",
-    #     table_body: "TableBody", # required
+    #     table_body: "TableBody",
+    #     query_id: "QueryId",
     #     kms_key_id: "KmsKeyId",
     #     tags: {
     #       "TagKey" => "TagValue",
@@ -1454,8 +1465,10 @@ module Aws::CloudWatchLogs
     #   time window relative to the execution time over which the query runs.
     #
     # @option params [Types::DestinationConfiguration] :destination_configuration
-    #   Configuration for where to deliver query results. Currently supports
-    #   Amazon S3 destinations for storing query output.
+    #   Configuration for where to deliver query results. Supports Amazon S3
+    #   destinations for storing query output and lookup table destinations
+    #   for automatically refreshing lookup tables with query results. You can
+    #   configure one or both destination types.
     #
     # @option params [Integer] :schedule_start_time
     #   The start time for the scheduled query in Unix epoch format. The query
@@ -1497,12 +1510,21 @@ module Aws::CloudWatchLogs
     #     start_time_offset: 1,
     #     end_time_offset: 1,
     #     destination_configuration: {
-    #       s3_configuration: { # required
+    #       s3_configuration: {
     #         destination_identifier: "S3Uri", # required
     #         role_arn: "RoleArn", # required
     #         owner_account_id: "AccountId",
     #         kms_key_id: "KmsKeyId",
     #       },
+    #       lookup_table_configuration: {
+    #         table_name: "LookupTableName", # required
+    #         role_arn: "RoleArn", # required
+    #         description: "LookupTableDescription",
+    #         kms_key_id: "KmsKeyId",
+    #         tags: {
+    #           "TagKey" => "TagValue",
+    #         },
+    #       },
     #     },
     #     schedule_start_time: 1,
     #     schedule_end_time: 1,
@@ -2642,9 +2664,13 @@ module Aws::CloudWatchLogs
       req.send_request(options)
     end
 
-    # Returns a list of custom and default field indexes which are
-    # discovered in log data. For more information about field index
-    # policies, see [PutIndexPolicy][1].
+    # Returns a list of field indexes discovered in log data. By default,
+    # the response includes the `DEFAULT`, `CUSTOM`, and `INACTIVE` index
+    # categories. To return indexes from other categories, use the
+    # `indexCategories` parameter.
+    #
+    # For more information about field index policies, see
+    # [PutIndexPolicy][1].
     #
     #
     #
@@ -2654,6 +2680,38 @@ module Aws::CloudWatchLogs
     #   An array containing the names or ARNs of the log groups that you want
     #   to retrieve field indexes for.
     #
+    # @option params [Array<String>] :index_categories
+    #   The index categories to return. The following values are supported:
+    #
+    #   * `DEFAULT`: Fields that CloudWatch Logs indexes by default. Examples
+    #     include `@logStream` and `@data_format`.
+    #
+    #   * `CUSTOM`: Fields that you added manually to the field index policy.
+    #     CloudWatch Logs always indexes these fields. These fields count
+    #     toward the quota of 20 fields for each log group.
+    #
+    #   * `AUTO`: Fields that CloudWatch Logs indexes automatically based on
+    #     your query patterns and usage. These fields do not count toward the
+    #     field index quota. CloudWatch Logs might update these fields based
+    #     on changes in your query patterns. To keep a field indexed
+    #     permanently, add it to an account-level or log-group level field
+    #     index policy.
+    #
+    #   * `INACTIVE`: Fields that CloudWatch Logs indexed before but does not
+    #     index now. This happens if you remove a field from the field index
+    #     policy or if CloudWatch Logs automatically selects a different field
+    #     based on your queries.
+    #
+    #   If you omit this parameter, the response includes the `DEFAULT`,
+    #   `CUSTOM`, and `INACTIVE` categories.
+    #
+    #   For more information about automatically indexed fields and using the
+    #   `AUTO` category, see [Automatically indexed fields][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing-Automatic.html
+    #
     # @option params [String] :next_token
     #   The token for the next set of items to return. The token expires after
     #   24 hours.
@@ -2667,6 +2725,7 @@ module Aws::CloudWatchLogs
     #
     #   resp = client.describe_field_indexes({
     #     log_group_identifiers: ["LogGroupIdentifier"], # required
+    #     index_categories: ["DEFAULT"], # accepts DEFAULT, CUSTOM, AUTO, INACTIVE
     #     next_token: "NextToken",
     #   })
     #
@@ -2679,6 +2738,7 @@ module Aws::CloudWatchLogs
     #   resp.field_indexes[0].first_event_time #=> Integer
     #   resp.field_indexes[0].last_event_time #=> Integer
     #   resp.field_indexes[0].type #=> String, one of "FACET", "FIELD_INDEX"
+    #   resp.field_indexes[0].index_category #=> String, one of "DEFAULT", "CUSTOM", "AUTO", "INACTIVE"
     #   resp.next_token #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/logs-2014-03-28/DescribeFieldIndexes AWS API Documentation
@@ -3716,6 +3776,11 @@ module Aws::CloudWatchLogs
     #   after `Jan 1, 1970 00:00:00 UTC`. Events with a timestamp before this
     #   time are not returned.
     #
+    #   <note markdown="1"> Set `startTime` explicitly to reduce the chances of empty pages in the
+    #   response.
+    #
+    #    </note>
+    #
     # @option params [Integer] :end_time
     #   The end of the time range, expressed as the number of milliseconds
     #   after `Jan 1, 1970 00:00:00 UTC`. Events with a timestamp later than
@@ -4215,6 +4280,11 @@ module Aws::CloudWatchLogs
     #   this time or later than this time are included. Events with a
     #   timestamp earlier than this time are not included.
     #
+    #   <note markdown="1"> Set `startTime` explicitly to reduce the chances of empty pages in the
+    #   response.
+    #
+    #    </note>
+    #
     # @option params [Integer] :end_time
     #   The end of the time range, expressed as the number of milliseconds
     #   after `Jan 1, 1970 00:00:00 UTC`. Events with a timestamp equal to or
@@ -4830,6 +4900,12 @@ module Aws::CloudWatchLogs
     #   resp.destination_configuration.s3_configuration.role_arn #=> String
     #   resp.destination_configuration.s3_configuration.owner_account_id #=> String
     #   resp.destination_configuration.s3_configuration.kms_key_id #=> String
+    #   resp.destination_configuration.lookup_table_configuration.table_name #=> String
+    #   resp.destination_configuration.lookup_table_configuration.role_arn #=> String
+    #   resp.destination_configuration.lookup_table_configuration.description #=> String
+    #   resp.destination_configuration.lookup_table_configuration.kms_key_id #=> String
+    #   resp.destination_configuration.lookup_table_configuration.tags #=> Hash
+    #   resp.destination_configuration.lookup_table_configuration.tags["TagKey"] #=> String
     #   resp.state #=> String, one of "ENABLED", "DISABLED"
     #   resp.schedule_type #=> String, one of "CUSTOMER_MANAGED", "AWS_MANAGED"
     #   resp.last_triggered_time #=> Integer
@@ -4904,7 +4980,7 @@ module Aws::CloudWatchLogs
     #   resp.trigger_history[0].triggered_timestamp #=> Integer
     #   resp.trigger_history[0].error_message #=> String
     #   resp.trigger_history[0].destinations #=> Array
-    #   resp.trigger_history[0].destinations[0].destination_type #=> String, one of "S3"
+    #   resp.trigger_history[0].destinations[0].destination_type #=> String, one of "S3", "LOOKUP_TABLE"
     #   resp.trigger_history[0].destinations[0].destination_identifier #=> String
     #   resp.trigger_history[0].destinations[0].status #=> String, one of "IN_PROGRESS", "CLIENT_ERROR", "FAILED", "COMPLETE"
     #   resp.trigger_history[0].destinations[0].processed_identifier #=> String
@@ -4920,7 +4996,7 @@ module Aws::CloudWatchLogs
       req.send_request(options)
     end
 
-    # Returns the storage tier policy for your account.
+    # Returns the storage tier policy for the account.
     #
     # @return [Types::GetStorageTierPolicyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -5598,6 +5674,12 @@ module Aws::CloudWatchLogs
     #   resp.scheduled_queries[0].destination_configuration.s3_configuration.role_arn #=> String
     #   resp.scheduled_queries[0].destination_configuration.s3_configuration.owner_account_id #=> String
     #   resp.scheduled_queries[0].destination_configuration.s3_configuration.kms_key_id #=> String
+    #   resp.scheduled_queries[0].destination_configuration.lookup_table_configuration.table_name #=> String
+    #   resp.scheduled_queries[0].destination_configuration.lookup_table_configuration.role_arn #=> String
+    #   resp.scheduled_queries[0].destination_configuration.lookup_table_configuration.description #=> String
+    #   resp.scheduled_queries[0].destination_configuration.lookup_table_configuration.kms_key_id #=> String
+    #   resp.scheduled_queries[0].destination_configuration.lookup_table_configuration.tags #=> Hash
+    #   resp.scheduled_queries[0].destination_configuration.lookup_table_configuration.tags["TagKey"] #=> String
     #   resp.scheduled_queries[0].creation_time #=> Integer
     #   resp.scheduled_queries[0].last_updated_time #=> Integer
     #
@@ -6808,6 +6890,10 @@ module Aws::CloudWatchLogs
     # @option params [required, String] :log_type
     #   Defines the type of log that the source is sending.
     #
+    #   * For Application Load Balancer, the valid values are
+    #     `ALB_ACCESS_LOGS`, `ALB_CONNECTION_LOGS`, and
+    #     `ALB_HEALTH_CHECK_LOGS`.
+    #
     #   * For Amazon Bedrock Agents, the valid values are `APPLICATION_LOGS`
     #     and `EVENT_LOGS`.
     #
@@ -7830,14 +7916,15 @@ module Aws::CloudWatchLogs
       req.send_request(options)
     end
 
-    # Sets the storage tier policy for your account. When you set the
-    # storage tier to `INTELLIGENT_TIERING`, CloudWatch Logs automatically
-    # moves your log data between storage tiers based on access patterns to
-    # optimize costs.
+    # Sets the storage tier policy for the account. When you set the storage
+    # tier to `INTELLIGENT_TIERING`, the service automatically moves log
+    # data to the most cost-effective storage tier based on access
+    # frequency.
     #
     # @option params [required, String] :storage_tier
-    #   The storage tier to set for the account. Valid values are `STANDARD`
-    #   and `INTELLIGENT_TIERING`.
+    #   The storage tier to set for the account. Use `INTELLIGENT_TIERING` to
+    #   automatically optimize storage costs by moving log data to the
+    #   appropriate tier based on access frequency.
     #
     # @return [Types::PutStorageTierPolicyResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -7985,9 +8072,9 @@ module Aws::CloudWatchLogs
     #
     # @option params [Array<String>] :emit_system_fields
     #   A list of system fields to include in the log events sent to the
-    #   subscription destination. Valid values are `@aws.account` and
-    #   `@aws.region`. These fields provide source information for centralized
-    #   log data in the forwarded payload.
+    #   subscription destination. Valid values are `@aws.account`,
+    #   `@aws.region`, and `@source.log`. These fields provide source
+    #   information for centralized log data in the forwarded payload.
     #
     # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
     #
@@ -9354,12 +9441,13 @@ module Aws::CloudWatchLogs
       req.send_request(options)
     end
 
-    # Updates an existing lookup table by replacing all of its CSV content.
-    # After the update completes, queries that use this table will use the
-    # new data.
+    # Updates an existing lookup table by replacing all of its content with
+    # new CSV data or CloudWatch Logs query results. After the update
+    # completes, queries that use this table use the new data.
     #
-    # This is a full replacement operation. All existing content is replaced
-    # with the new CSV data.
+    # This is a full replacement operation. All existing content is
+    # replaced. You must specify either `tableBody` or `queryId`, but not
+    # both.
     #
     # @option params [required, String] :lookup_table_arn
     #   The ARN of the lookup table to update.
@@ -9367,11 +9455,21 @@ module Aws::CloudWatchLogs
     # @option params [String] :description
     #   An updated description of the lookup table.
     #
-    # @option params [required, String] :table_body
+    # @option params [String] :table_body
     #   The new CSV content to replace the existing data. The first row must
     #   be a header row with column names. The content must use UTF-8 encoding
     #   and not exceed 10 MB.
     #
+    #   You must specify either `tableBody` or `queryId`, but not both.
+    #
+    # @option params [String] :query_id
+    #   The ID of a completed or cancelled CloudWatch Logs query whose results
+    #   replace the lookup table content. A cancelled query replaces the
+    #   content with the partial results that were available when the query
+    #   was stopped.
+    #
+    #   You must specify either `tableBody` or `queryId`, but not both.
+    #
     # @option params [String] :kms_key_id
     #   The ARN of the KMS key to use to encrypt the lookup table data. You
     #   can use this parameter to add, update, or remove the KMS key. To
@@ -9388,7 +9486,8 @@ module Aws::CloudWatchLogs
     #   resp = client.update_lookup_table({
     #     lookup_table_arn: "Arn", # required
     #     description: "LookupTableDescription",
-    #     table_body: "TableBody", # required
+    #     table_body: "TableBody",
+    #     query_id: "QueryId",
     #     kms_key_id: "KmsKeyId",
     #   })
     #
@@ -9492,12 +9591,21 @@ module Aws::CloudWatchLogs
     #     start_time_offset: 1,
     #     end_time_offset: 1,
     #     destination_configuration: {
-    #       s3_configuration: { # required
+    #       s3_configuration: {
     #         destination_identifier: "S3Uri", # required
     #         role_arn: "RoleArn", # required
     #         owner_account_id: "AccountId",
     #         kms_key_id: "KmsKeyId",
     #       },
+    #       lookup_table_configuration: {
+    #         table_name: "LookupTableName", # required
+    #         role_arn: "RoleArn", # required
+    #         description: "LookupTableDescription",
+    #         kms_key_id: "KmsKeyId",
+    #         tags: {
+    #           "TagKey" => "TagValue",
+    #         },
+    #       },
     #     },
     #     schedule_start_time: 1,
     #     schedule_end_time: 1,
@@ -9522,6 +9630,12 @@ module Aws::CloudWatchLogs
     #   resp.destination_configuration.s3_configuration.role_arn #=> String
     #   resp.destination_configuration.s3_configuration.owner_account_id #=> String
     #   resp.destination_configuration.s3_configuration.kms_key_id #=> String
+    #   resp.destination_configuration.lookup_table_configuration.table_name #=> String
+    #   resp.destination_configuration.lookup_table_configuration.role_arn #=> String
+    #   resp.destination_configuration.lookup_table_configuration.description #=> String
+    #   resp.destination_configuration.lookup_table_configuration.kms_key_id #=> String
+    #   resp.destination_configuration.lookup_table_configuration.tags #=> Hash
+    #   resp.destination_configuration.lookup_table_configuration.tags["TagKey"] #=> String
     #   resp.state #=> String, one of "ENABLED", "DISABLED"
     #   resp.schedule_type #=> String, one of "CUSTOMER_MANAGED", "AWS_MANAGED"
     #   resp.last_triggered_time #=> Integer
@@ -9559,7 +9673,7 @@ module Aws::CloudWatchLogs
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-cloudwatchlogs'
-      context[:gem_version] = '1.159.0'
+      context[:gem_version] = '1.161.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-cloudwatchlogs/client_api.rb

@@ -323,6 +323,8 @@ module Aws::CloudWatchLogs
     ImportStatus = Shapes::StringShape.new(name: 'ImportStatus')
     ImportStatusList = Shapes::ListShape.new(name: 'ImportStatusList')
     IncludeLinkedAccounts = Shapes::BooleanShape.new(name: 'IncludeLinkedAccounts')
+    IndexCategories = Shapes::ListShape.new(name: 'IndexCategories')
+    IndexCategory = Shapes::StringShape.new(name: 'IndexCategory')
     IndexPolicies = Shapes::ListShape.new(name: 'IndexPolicies')
     IndexPolicy = Shapes::StructureShape.new(name: 'IndexPolicy')
     IndexSource = Shapes::StringShape.new(name: 'IndexSource')
@@ -425,6 +427,7 @@ module Aws::CloudWatchLogs
     LogType = Shapes::StringShape.new(name: 'LogType')
     LogTypes = Shapes::ListShape.new(name: 'LogTypes')
     LookupTable = Shapes::StructureShape.new(name: 'LookupTable')
+    LookupTableConfiguration = Shapes::StructureShape.new(name: 'LookupTableConfiguration')
     LookupTableDescription = Shapes::StringShape.new(name: 'LookupTableDescription')
     LookupTableName = Shapes::StringShape.new(name: 'LookupTableName')
     LookupTables = Shapes::ListShape.new(name: 'LookupTables')
@@ -906,7 +909,8 @@ module Aws::CloudWatchLogs
 
     CreateLookupTableRequest.add_member(:lookup_table_name, Shapes::ShapeRef.new(shape: LookupTableName, required: true, location_name: "lookupTableName"))
     CreateLookupTableRequest.add_member(:description, Shapes::ShapeRef.new(shape: LookupTableDescription, location_name: "description"))
-    CreateLookupTableRequest.add_member(:table_body, Shapes::ShapeRef.new(shape: TableBody, required: true, location_name: "tableBody"))
+    CreateLookupTableRequest.add_member(:table_body, Shapes::ShapeRef.new(shape: TableBody, location_name: "tableBody"))
+    CreateLookupTableRequest.add_member(:query_id, Shapes::ShapeRef.new(shape: QueryId, location_name: "queryId"))
     CreateLookupTableRequest.add_member(:kms_key_id, Shapes::ShapeRef.new(shape: KmsKeyId, location_name: "kmsKeyId"))
     CreateLookupTableRequest.add_member(:tags, Shapes::ShapeRef.new(shape: Tags, location_name: "tags"))
     CreateLookupTableRequest.struct_class = Types::CreateLookupTableRequest
@@ -1169,6 +1173,7 @@ module Aws::CloudWatchLogs
     DescribeFieldIndexesLogGroupIdentifiers.member = Shapes::ShapeRef.new(shape: LogGroupIdentifier)
 
     DescribeFieldIndexesRequest.add_member(:log_group_identifiers, Shapes::ShapeRef.new(shape: DescribeFieldIndexesLogGroupIdentifiers, required: true, location_name: "logGroupIdentifiers"))
+    DescribeFieldIndexesRequest.add_member(:index_categories, Shapes::ShapeRef.new(shape: IndexCategories, location_name: "indexCategories"))
     DescribeFieldIndexesRequest.add_member(:next_token, Shapes::ShapeRef.new(shape: NextToken, location_name: "nextToken"))
     DescribeFieldIndexesRequest.struct_class = Types::DescribeFieldIndexesRequest
 
@@ -1308,7 +1313,8 @@ module Aws::CloudWatchLogs
     Destination.add_member(:creation_time, Shapes::ShapeRef.new(shape: Timestamp, location_name: "creationTime"))
     Destination.struct_class = Types::Destination
 
-    DestinationConfiguration.add_member(:s3_configuration, Shapes::ShapeRef.new(shape: S3Configuration, required: true, location_name: "s3Configuration"))
+    DestinationConfiguration.add_member(:s3_configuration, Shapes::ShapeRef.new(shape: S3Configuration, location_name: "s3Configuration"))
+    DestinationConfiguration.add_member(:lookup_table_configuration, Shapes::ShapeRef.new(shape: LookupTableConfiguration, location_name: "lookupTableConfiguration"))
     DestinationConfiguration.struct_class = Types::DestinationConfiguration
 
     Destinations.member = Shapes::ShapeRef.new(shape: Destination)
@@ -1373,6 +1379,7 @@ module Aws::CloudWatchLogs
     FieldIndex.add_member(:first_event_time, Shapes::ShapeRef.new(shape: Timestamp, location_name: "firstEventTime"))
     FieldIndex.add_member(:last_event_time, Shapes::ShapeRef.new(shape: Timestamp, location_name: "lastEventTime"))
     FieldIndex.add_member(:type, Shapes::ShapeRef.new(shape: IndexType, location_name: "type"))
+    FieldIndex.add_member(:index_category, Shapes::ShapeRef.new(shape: IndexCategory, location_name: "indexCategory"))
     FieldIndex.struct_class = Types::FieldIndex
 
     FieldIndexNames.member = Shapes::ShapeRef.new(shape: FieldIndexName)
@@ -1635,6 +1642,8 @@ module Aws::CloudWatchLogs
 
     ImportStatusList.member = Shapes::ShapeRef.new(shape: ImportStatus)
 
+    IndexCategories.member = Shapes::ShapeRef.new(shape: IndexCategory)
+
     IndexPolicies.member = Shapes::ShapeRef.new(shape: IndexPolicy)
 
     IndexPolicy.add_member(:log_group_identifier, Shapes::ShapeRef.new(shape: LogGroupIdentifier, location_name: "logGroupIdentifier"))
@@ -1899,6 +1908,13 @@ module Aws::CloudWatchLogs
     LookupTable.add_member(:kms_key_id, Shapes::ShapeRef.new(shape: KmsKeyId, location_name: "kmsKeyId"))
     LookupTable.struct_class = Types::LookupTable
 
+    LookupTableConfiguration.add_member(:table_name, Shapes::ShapeRef.new(shape: LookupTableName, required: true, location_name: "tableName"))
+    LookupTableConfiguration.add_member(:role_arn, Shapes::ShapeRef.new(shape: RoleArn, required: true, location_name: "roleArn"))
+    LookupTableConfiguration.add_member(:description, Shapes::ShapeRef.new(shape: LookupTableDescription, location_name: "description"))
+    LookupTableConfiguration.add_member(:kms_key_id, Shapes::ShapeRef.new(shape: KmsKeyId, location_name: "kmsKeyId"))
+    LookupTableConfiguration.add_member(:tags, Shapes::ShapeRef.new(shape: Tags, location_name: "tags"))
+    LookupTableConfiguration.struct_class = Types::LookupTableConfiguration
+
     LookupTables.member = Shapes::ShapeRef.new(shape: LookupTable)
 
     LowerCaseString.add_member(:with_keys, Shapes::ShapeRef.new(shape: LowerCaseStringWithKeys, required: true, location_name: "withKeys"))
@@ -2609,7 +2625,8 @@ module Aws::CloudWatchLogs
 
     UpdateLookupTableRequest.add_member(:lookup_table_arn, Shapes::ShapeRef.new(shape: Arn, required: true, location_name: "lookupTableArn"))
     UpdateLookupTableRequest.add_member(:description, Shapes::ShapeRef.new(shape: LookupTableDescription, location_name: "description"))
-    UpdateLookupTableRequest.add_member(:table_body, Shapes::ShapeRef.new(shape: TableBody, required: true, location_name: "tableBody"))
+    UpdateLookupTableRequest.add_member(:table_body, Shapes::ShapeRef.new(shape: TableBody, location_name: "tableBody"))
+    UpdateLookupTableRequest.add_member(:query_id, Shapes::ShapeRef.new(shape: QueryId, location_name: "queryId"))
     UpdateLookupTableRequest.add_member(:kms_key_id, Shapes::ShapeRef.new(shape: KmsKeyId, location_name: "kmsKeyId"))
     UpdateLookupTableRequest.struct_class = Types::UpdateLookupTableRequest
 

data/lib/aws-sdk-cloudwatchlogs/types.rb

@@ -1159,6 +1159,17 @@ module Aws::CloudWatchLogs
     #   The CSV content of the lookup table. The first row must be a header
     #   row with column names. The content must use UTF-8 encoding and not
     #   exceed 10 MB.
+    #
+    #   You must specify either `tableBody` or `queryId`, but not both.
+    #   @return [String]
+    #
+    # @!attribute [rw] query_id
+    #   The ID of a completed or cancelled CloudWatch Logs query whose
+    #   results populate the lookup table. A cancelled query populates the
+    #   table with the partial results that were available when the query
+    #   was stopped.
+    #
+    #   You must specify either `tableBody` or `queryId`, but not both.
     #   @return [String]
     #
     # @!attribute [rw] kms_key_id
@@ -1179,6 +1190,7 @@ module Aws::CloudWatchLogs
       :lookup_table_name,
       :description,
       :table_body,
+      :query_id,
       :kms_key_id,
       :tags)
       SENSITIVE = []
@@ -1255,8 +1267,10 @@ module Aws::CloudWatchLogs
     #   @return [Integer]
     #
     # @!attribute [rw] destination_configuration
-    #   Configuration for where to deliver query results. Currently supports
-    #   Amazon S3 destinations for storing query output.
+    #   Configuration for where to deliver query results. Supports Amazon S3
+    #   destinations for storing query output and lookup table destinations
+    #   for automatically refreshing lookup tables with query results. You
+    #   can configure one or both destination types.
     #   @return [Types::DestinationConfiguration]
     #
     # @!attribute [rw] schedule_start_time
@@ -2476,6 +2490,39 @@ module Aws::CloudWatchLogs
     #   want to retrieve field indexes for.
     #   @return [Array<String>]
     #
+    # @!attribute [rw] index_categories
+    #   The index categories to return. The following values are supported:
+    #
+    #   * `DEFAULT`: Fields that CloudWatch Logs indexes by default.
+    #     Examples include `@logStream` and `@data_format`.
+    #
+    #   * `CUSTOM`: Fields that you added manually to the field index
+    #     policy. CloudWatch Logs always indexes these fields. These fields
+    #     count toward the quota of 20 fields for each log group.
+    #
+    #   * `AUTO`: Fields that CloudWatch Logs indexes automatically based on
+    #     your query patterns and usage. These fields do not count toward
+    #     the field index quota. CloudWatch Logs might update these fields
+    #     based on changes in your query patterns. To keep a field indexed
+    #     permanently, add it to an account-level or log-group level field
+    #     index policy.
+    #
+    #   * `INACTIVE`: Fields that CloudWatch Logs indexed before but does
+    #     not index now. This happens if you remove a field from the field
+    #     index policy or if CloudWatch Logs automatically selects a
+    #     different field based on your queries.
+    #
+    #   If you omit this parameter, the response includes the `DEFAULT`,
+    #   `CUSTOM`, and `INACTIVE` categories.
+    #
+    #   For more information about automatically indexed fields and using
+    #   the `AUTO` category, see [Automatically indexed fields][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing-Automatic.html
+    #   @return [Array<String>]
+    #
     # @!attribute [rw] next_token
     #   The token for the next set of items to return. The token expires
     #   after 24 hours.
@@ -2485,6 +2532,7 @@ module Aws::CloudWatchLogs
     #
     class DescribeFieldIndexesRequest < Struct.new(
       :log_group_identifiers,
+      :index_categories,
       :next_token)
       SENSITIVE = []
       include Aws::Structure
@@ -3238,10 +3286,17 @@ module Aws::CloudWatchLogs
     #   Configuration for delivering query results to Amazon S3.
     #   @return [Types::S3Configuration]
     #
+    # @!attribute [rw] lookup_table_configuration
+    #   Configuration for delivering query results to a lookup table. The
+    #   query results automatically populate or refresh the specified lookup
+    #   table on each scheduled execution.
+    #   @return [Types::LookupTableConfiguration]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/logs-2014-03-28/DestinationConfiguration AWS API Documentation
     #
     class DestinationConfiguration < Struct.new(
-      :s3_configuration)
+      :s3_configuration,
+      :lookup_table_configuration)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -3489,6 +3544,36 @@ module Aws::CloudWatchLogs
     #   field is indexed and can be queried.
     #   @return [String]
     #
+    # @!attribute [rw] index_category
+    #   The category of the field index:
+    #
+    #   * `DEFAULT`: Fields that CloudWatch Logs indexes by default.
+    #     Examples include `@logStream` and `@data_format`.
+    #
+    #   * `CUSTOM`: Fields that you added manually to the field index
+    #     policy. CloudWatch Logs always indexes these fields. These fields
+    #     count toward the quota of 20 fields for each log group.
+    #
+    #   * `AUTO`: Fields that CloudWatch Logs indexes automatically based on
+    #     your query patterns and usage. These fields do not count toward
+    #     the field index quota. CloudWatch Logs might update these fields
+    #     based on changes in your query patterns. To keep a field indexed
+    #     permanently, add it to an account-level or log-group level field
+    #     index policy.
+    #
+    #   * `INACTIVE`: Fields that CloudWatch Logs indexed before but does
+    #     not index now. This happens if you remove a field from the field
+    #     index policy or if CloudWatch Logs automatically selects a
+    #     different field based on your queries.
+    #
+    #   For more information about automatically indexed fields, see
+    #   [Automatically indexed fields][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing-Automatic.html
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/logs-2014-03-28/FieldIndex AWS API Documentation
     #
     class FieldIndex < Struct.new(
@@ -3497,7 +3582,8 @@ module Aws::CloudWatchLogs
       :last_scan_time,
       :first_event_time,
       :last_event_time,
-      :type)
+      :type,
+      :index_category)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -3562,6 +3648,11 @@ module Aws::CloudWatchLogs
     #   The start of the time range, expressed as the number of milliseconds
     #   after `Jan 1, 1970 00:00:00 UTC`. Events with a timestamp before
     #   this time are not returned.
+    #
+    #   <note markdown="1"> Set `startTime` explicitly to reduce the chances of empty pages in
+    #   the response.
+    #
+    #    </note>
     #   @return [Integer]
     #
     # @!attribute [rw] end_time
@@ -4012,6 +4103,11 @@ module Aws::CloudWatchLogs
     #   after `Jan 1, 1970 00:00:00 UTC`. Events with a timestamp equal to
     #   this time or later than this time are included. Events with a
     #   timestamp earlier than this time are not included.
+    #
+    #   <note markdown="1"> Set `startTime` explicitly to reduce the chances of empty pages in
+    #   the response.
+    #
+    #    </note>
     #   @return [Integer]
     #
     # @!attribute [rw] end_time
@@ -4607,7 +4703,7 @@ module Aws::CloudWatchLogs
     #
     # @!attribute [rw] last_updated_time
     #   The time when the storage tier policy was last updated, expressed as
-    #   the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`.
+    #   the number of milliseconds after `January 1, 1970 00:00:00 UTC`.
     #   @return [Integer]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/logs-2014-03-28/GetStorageTierPolicyResponse AWS API Documentation
@@ -6205,6 +6301,47 @@ module Aws::CloudWatchLogs
       include Aws::Structure
     end
 
+    # Configuration for a lookup table destination. Use it to automatically
+    # refresh a lookup table with query results on a schedule.
+    #
+    # @!attribute [rw] table_name
+    #   The name of the lookup table to create or update with query results.
+    #   The name can contain only alphanumeric characters and underscores.
+    #   @return [String]
+    #
+    # @!attribute [rw] role_arn
+    #   The ARN of the IAM role that grants permissions to create or update
+    #   the lookup table with query results.
+    #   @return [String]
+    #
+    # @!attribute [rw] description
+    #   A description of the lookup table.
+    #   @return [String]
+    #
+    # @!attribute [rw] kms_key_id
+    #   The ARN of the KMS key to use to encrypt the lookup table data. If
+    #   you don't specify a key, the data is encrypted with an Amazon Web
+    #   Services-owned key.
+    #   @return [String]
+    #
+    # @!attribute [rw] tags
+    #   Key-value pairs to associate with the lookup table for resource
+    #   management and cost allocation. The service applies tags only during
+    #   initial table creation.
+    #   @return [Hash<String,String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/logs-2014-03-28/LookupTableConfiguration AWS API Documentation
+    #
+    class LookupTableConfiguration < Struct.new(
+      :table_name,
+      :role_arn,
+      :description,
+      :kms_key_id,
+      :tags)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # This processor converts a string to lowercase.
     #
     # For more information about this processor including examples, see [
@@ -7984,6 +8121,10 @@ module Aws::CloudWatchLogs
     # @!attribute [rw] log_type
     #   Defines the type of log that the source is sending.
     #
+    #   * For Application Load Balancer, the valid values are
+    #     `ALB_ACCESS_LOGS`, `ALB_CONNECTION_LOGS`, and
+    #     `ALB_HEALTH_CHECK_LOGS`.
+    #
     #   * For Amazon Bedrock Agents, the valid values are `APPLICATION_LOGS`
     #     and `EVENT_LOGS`.
     #
@@ -8671,8 +8812,9 @@ module Aws::CloudWatchLogs
     end
 
     # @!attribute [rw] storage_tier
-    #   The storage tier to set for the account. Valid values are `STANDARD`
-    #   and `INTELLIGENT_TIERING`.
+    #   The storage tier to set for the account. Use `INTELLIGENT_TIERING`
+    #   to automatically optimize storage costs by moving log data to the
+    #   appropriate tier based on access frequency.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/logs-2014-03-28/PutStorageTierPolicyRequest AWS API Documentation
@@ -8684,12 +8826,12 @@ module Aws::CloudWatchLogs
     end
 
     # @!attribute [rw] storage_tier
-    #   The storage tier that was set.
+    #   The storage tier for the account.
     #   @return [String]
     #
     # @!attribute [rw] last_updated_time
     #   The time when the storage tier policy was last updated, expressed as
-    #   the number of milliseconds after `Jan 1, 1970 00:00:00 UTC`.
+    #   the number of milliseconds after `January 1, 1970 00:00:00 UTC`.
     #   @return [Integer]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/logs-2014-03-28/PutStorageTierPolicyResponse AWS API Documentation
@@ -8787,9 +8929,9 @@ module Aws::CloudWatchLogs
     #
     # @!attribute [rw] emit_system_fields
     #   A list of system fields to include in the log events sent to the
-    #   subscription destination. Valid values are `@aws.account` and
-    #   `@aws.region`. These fields provide source information for
-    #   centralized log data in the forwarded payload.
+    #   subscription destination. Valid values are `@aws.account`,
+    #   `@aws.region`, and `@source.log`. These fields provide source
+    #   information for centralized log data in the forwarded payload.
     #   @return [Array<String>]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/logs-2014-03-28/PutSubscriptionFilterRequest AWS API Documentation
@@ -10596,6 +10738,17 @@ module Aws::CloudWatchLogs
     #   The new CSV content to replace the existing data. The first row must
     #   be a header row with column names. The content must use UTF-8
     #   encoding and not exceed 10 MB.
+    #
+    #   You must specify either `tableBody` or `queryId`, but not both.
+    #   @return [String]
+    #
+    # @!attribute [rw] query_id
+    #   The ID of a completed or cancelled CloudWatch Logs query whose
+    #   results replace the lookup table content. A cancelled query replaces
+    #   the content with the partial results that were available when the
+    #   query was stopped.
+    #
+    #   You must specify either `tableBody` or `queryId`, but not both.
     #   @return [String]
     #
     # @!attribute [rw] kms_key_id
@@ -10611,6 +10764,7 @@ module Aws::CloudWatchLogs
       :lookup_table_arn,
       :description,
       :table_body,
+      :query_id,
       :kms_key_id)
       SENSITIVE = []
       include Aws::Structure

data/lib/aws-sdk-cloudwatchlogs.rb

@@ -55,7 +55,7 @@ module Aws::CloudWatchLogs
   autoload :Endpoints, 'aws-sdk-cloudwatchlogs/endpoints'
   autoload :EventStreams, 'aws-sdk-cloudwatchlogs/event_streams'
 
-  GEM_VERSION = '1.159.0'
+  GEM_VERSION = '1.161.0'
 
 end
 

data/sig/client.rbs

@@ -217,7 +217,8 @@ module Aws
       def create_lookup_table: (
                                  lookup_table_name: ::String,
                                  ?description: ::String,
-                                 table_body: ::String,
+                                 ?table_body: ::String,
+                                 ?query_id: ::String,
                                  ?kms_key_id: ::String,
                                  ?tags: Hash[::String, ::String]
                                ) -> _CreateLookupTableResponseSuccess
@@ -496,6 +497,7 @@ module Aws
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CloudWatchLogs/Client.html#describe_field_indexes-instance_method
       def describe_field_indexes: (
                                     log_group_identifiers: Array[::String],
+                                    ?index_categories: Array[("DEFAULT" | "CUSTOM" | "AUTO" | "INACTIVE")],
                                     ?next_token: ::String
                                   ) -> _DescribeFieldIndexesResponseSuccess
                                 | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DescribeFieldIndexesResponseSuccess
@@ -1524,7 +1526,8 @@ module Aws
       def update_lookup_table: (
                                  lookup_table_arn: ::String,
                                  ?description: ::String,
-                                 table_body: ::String,
+                                 ?table_body: ::String,
+                                 ?query_id: ::String,
                                  ?kms_key_id: ::String
                                ) -> _UpdateLookupTableResponseSuccess
                              | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _UpdateLookupTableResponseSuccess

data/sig/params.rbs

@@ -14,7 +14,14 @@ module Aws
         role_arn: ::String,
         owner_account_id: ::String?,
         kms_key_id: ::String?
-      }
+      }?,
+      lookup_table_configuration: {
+        table_name: ::String,
+        role_arn: ::String,
+        description: ::String?,
+        kms_key_id: ::String?,
+        tags: Hash[::String, ::String]?
+      }?
     }
 
       type date_time_converter = {

data/sig/types.rbs

@@ -241,6 +241,7 @@ module Aws::CloudWatchLogs
       attr_accessor lookup_table_name: ::String
       attr_accessor description: ::String
       attr_accessor table_body: ::String
+      attr_accessor query_id: ::String
       attr_accessor kms_key_id: ::String
       attr_accessor tags: ::Hash[::String, ::String]
       SENSITIVE: []
@@ -583,6 +584,7 @@ module Aws::CloudWatchLogs
 
     class DescribeFieldIndexesRequest
       attr_accessor log_group_identifiers: ::Array[::String]
+      attr_accessor index_categories: ::Array[("DEFAULT" | "CUSTOM" | "AUTO" | "INACTIVE")]
       attr_accessor next_token: ::String
       SENSITIVE: []
     end
@@ -769,6 +771,7 @@ module Aws::CloudWatchLogs
 
     class DestinationConfiguration
       attr_accessor s3_configuration: Types::S3Configuration
+      attr_accessor lookup_table_configuration: Types::LookupTableConfiguration
       SENSITIVE: []
     end
 
@@ -826,6 +829,7 @@ module Aws::CloudWatchLogs
       attr_accessor first_event_time: ::Integer
       attr_accessor last_event_time: ::Integer
       attr_accessor type: ("FACET" | "FIELD_INDEX")
+      attr_accessor index_category: ("DEFAULT" | "CUSTOM" | "AUTO" | "INACTIVE")
       SENSITIVE: []
     end
 
@@ -1481,6 +1485,15 @@ module Aws::CloudWatchLogs
       SENSITIVE: []
     end
 
+    class LookupTableConfiguration
+      attr_accessor table_name: ::String
+      attr_accessor role_arn: ::String
+      attr_accessor description: ::String
+      attr_accessor kms_key_id: ::String
+      attr_accessor tags: ::Hash[::String, ::String]
+      SENSITIVE: []
+    end
+
     class LowerCaseString
       attr_accessor with_keys: ::Array[::String]
       SENSITIVE: []
@@ -2079,7 +2092,7 @@ module Aws::CloudWatchLogs
     end
 
     class ScheduledQueryDestination
-      attr_accessor destination_type: ("S3")
+      attr_accessor destination_type: ("S3" | "LOOKUP_TABLE")
       attr_accessor destination_identifier: ::String
       attr_accessor status: ("IN_PROGRESS" | "CLIENT_ERROR" | "FAILED" | "COMPLETE")
       attr_accessor processed_identifier: ::String
@@ -2347,6 +2360,7 @@ module Aws::CloudWatchLogs
       attr_accessor lookup_table_arn: ::String
       attr_accessor description: ::String
       attr_accessor table_body: ::String
+      attr_accessor query_id: ::String
       attr_accessor kms_key_id: ::String
       SENSITIVE: []
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-cloudwatchlogs
 version: !ruby/object:Gem::Version
-  version: 1.159.0
+  version: 1.161.0
 platform: ruby
 authors:
 - Amazon Web Services