aws-cdk-lib 2.219.0__py3-none-any.whl → 2.221.0__py3-none-any.whl

aws_cdk/aws_logs/__init__.py

@@ -553,6 +553,10 @@ logs.Transformer(self, "Transformer",
 
 For more details on CloudWatch Logs transformation processors, refer to the [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Processors.html).
 
+### Usage of metric filters on transformed logs
+
+In order to use the transformed logs as search pattern, set the parameter `applyOnTransformedLogs: true` in the MetricFilterProps.
+
 ## Notes
 
 Be aware that Log Group ARNs will always have the string `:*` appended to
@@ -1089,6 +1093,7 @@ class CfnAccountPolicyProps:
     name_mapping={
         "name": "name",
         "delivery_destination_policy": "deliveryDestinationPolicy",
+        "delivery_destination_type": "deliveryDestinationType",
         "destination_resource_arn": "destinationResourceArn",
         "output_format": "outputFormat",
         "tags": "tags",
@@ -1100,6 +1105,7 @@ class CfnDeliveryDestinationProps:
         *,
         name: builtins.str,
         delivery_destination_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDeliveryDestination.DestinationPolicyProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+        delivery_destination_type: typing.Optional[builtins.str] = None,
         destination_resource_arn: typing.Optional[builtins.str] = None,
         output_format: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -1108,6 +1114,7 @@ class CfnDeliveryDestinationProps:
 
         :param name: The name of this delivery destination.
         :param delivery_destination_policy: An IAM policy that grants permissions to CloudWatch Logs to deliver logs cross-account to a specified destination in this account. For examples of this policy, see `Examples <https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliveryDestinationPolicy.html#API_PutDeliveryDestinationPolicy_Examples>`_ in the CloudWatch Logs API Reference.
+        :param delivery_destination_type: Displays whether this delivery destination is CloudWatch Logs, Amazon S3, Firehose, or X-Ray.
         :param destination_resource_arn: The ARN of the AWS destination that this delivery destination represents. That AWS destination can be a log group in CloudWatch Logs , an Amazon S3 bucket, or a Firehose stream.
         :param output_format: The format of the logs that are sent to this delivery destination.
         :param tags: An array of key-value pairs to apply to the delivery destination. For more information, see `Tag <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html>`_ .
@@ -1131,6 +1138,7 @@ class CfnDeliveryDestinationProps:
                     delivery_destination_name="deliveryDestinationName",
                     delivery_destination_policy=delivery_destination_policy
                 ),
+                delivery_destination_type="deliveryDestinationType",
                 destination_resource_arn="destinationResourceArn",
                 output_format="outputFormat",
                 tags=[CfnTag(
@@ -1143,6 +1151,7 @@ class CfnDeliveryDestinationProps:
             type_hints = typing.get_type_hints(_typecheckingstub__53bbf04ee2b4b7e83a98258d41a973972fae20f7537731a0fbcda3e7c5f46c1c)
             check_type(argname="argument name", value=name, expected_type=type_hints["name"])
             check_type(argname="argument delivery_destination_policy", value=delivery_destination_policy, expected_type=type_hints["delivery_destination_policy"])
+            check_type(argname="argument delivery_destination_type", value=delivery_destination_type, expected_type=type_hints["delivery_destination_type"])
             check_type(argname="argument destination_resource_arn", value=destination_resource_arn, expected_type=type_hints["destination_resource_arn"])
             check_type(argname="argument output_format", value=output_format, expected_type=type_hints["output_format"])
             check_type(argname="argument tags", value=tags, expected_type=type_hints["tags"])
@@ -1151,6 +1160,8 @@ class CfnDeliveryDestinationProps:
         }
         if delivery_destination_policy is not None:
             self._values["delivery_destination_policy"] = delivery_destination_policy
+        if delivery_destination_type is not None:
+            self._values["delivery_destination_type"] = delivery_destination_type
         if destination_resource_arn is not None:
             self._values["destination_resource_arn"] = destination_resource_arn
         if output_format is not None:
@@ -1181,6 +1192,15 @@ class CfnDeliveryDestinationProps:
         result = self._values.get("delivery_destination_policy")
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnDeliveryDestination.DestinationPolicyProperty"]], result)
 
+    @builtins.property
+    def delivery_destination_type(self) -> typing.Optional[builtins.str]:
+        '''Displays whether this delivery destination is CloudWatch Logs, Amazon S3, Firehose, or X-Ray.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-deliverydestination.html#cfn-logs-deliverydestination-deliverydestinationtype
+        '''
+        result = self._values.get("delivery_destination_type")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def destination_resource_arn(self) -> typing.Optional[builtins.str]:
         '''The ARN of the AWS destination that this delivery destination represents.
@@ -2206,6 +2226,8 @@ class CfnLogStreamProps:
         "log_group_name": "logGroupName",
         "metric_transformations": "metricTransformations",
         "apply_on_transformed_logs": "applyOnTransformedLogs",
+        "emit_system_field_dimensions": "emitSystemFieldDimensions",
+        "field_selection_criteria": "fieldSelectionCriteria",
         "filter_name": "filterName",
     },
 )
@@ -2217,6 +2239,8 @@ class CfnMetricFilterProps:
         log_group_name: builtins.str,
         metric_transformations: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnMetricFilter.MetricTransformationProperty", typing.Dict[builtins.str, typing.Any]]]]],
         apply_on_transformed_logs: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+        emit_system_field_dimensions: typing.Optional[typing.Sequence[builtins.str]] = None,
+        field_selection_criteria: typing.Optional[builtins.str] = None,
         filter_name: typing.Optional[builtins.str] = None,
     ) -> None:
         '''Properties for defining a ``CfnMetricFilter``.
@@ -2225,6 +2249,8 @@ class CfnMetricFilterProps:
         :param log_group_name: The name of an existing log group that you want to associate with this metric filter.
         :param metric_transformations: The metric transformations.
         :param apply_on_transformed_logs: This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see `PutTransformer <https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutTransformer.html>`_ . If this value is ``true`` , the metric filter is applied on the transformed version of the log events instead of the original ingested log events.
+        :param emit_system_field_dimensions: The list of system fields that are emitted as additional dimensions in the generated metrics. Returns the ``emitSystemFieldDimensions`` value if it was specified when the metric filter was created.
+        :param field_selection_criteria: The filter expression that specifies which log events are processed by this metric filter based on system fields. Returns the ``fieldSelectionCriteria`` value if it was specified when the metric filter was created.
         :param filter_name: The name of the metric filter.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-metricfilter.html
@@ -2255,6 +2281,8 @@ class CfnMetricFilterProps:
             
                 # the properties below are optional
                 apply_on_transformed_logs=False,
+                emit_system_field_dimensions=["emitSystemFieldDimensions"],
+                field_selection_criteria="fieldSelectionCriteria",
                 filter_name="filterName"
             )
         '''
@@ -2264,6 +2292,8 @@ class CfnMetricFilterProps:
             check_type(argname="argument log_group_name", value=log_group_name, expected_type=type_hints["log_group_name"])
             check_type(argname="argument metric_transformations", value=metric_transformations, expected_type=type_hints["metric_transformations"])
             check_type(argname="argument apply_on_transformed_logs", value=apply_on_transformed_logs, expected_type=type_hints["apply_on_transformed_logs"])
+            check_type(argname="argument emit_system_field_dimensions", value=emit_system_field_dimensions, expected_type=type_hints["emit_system_field_dimensions"])
+            check_type(argname="argument field_selection_criteria", value=field_selection_criteria, expected_type=type_hints["field_selection_criteria"])
             check_type(argname="argument filter_name", value=filter_name, expected_type=type_hints["filter_name"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "filter_pattern": filter_pattern,
@@ -2272,6 +2302,10 @@ class CfnMetricFilterProps:
         }
         if apply_on_transformed_logs is not None:
             self._values["apply_on_transformed_logs"] = apply_on_transformed_logs
+        if emit_system_field_dimensions is not None:
+            self._values["emit_system_field_dimensions"] = emit_system_field_dimensions
+        if field_selection_criteria is not None:
+            self._values["field_selection_criteria"] = field_selection_criteria
         if filter_name is not None:
             self._values["filter_name"] = filter_name
 
@@ -2324,6 +2358,30 @@ class CfnMetricFilterProps:
         result = self._values.get("apply_on_transformed_logs")
         return typing.cast(typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]], result)
 
+    @builtins.property
+    def emit_system_field_dimensions(
+        self,
+    ) -> typing.Optional[typing.List[builtins.str]]:
+        '''The list of system fields that are emitted as additional dimensions in the generated metrics.
+
+        Returns the ``emitSystemFieldDimensions`` value if it was specified when the metric filter was created.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-metricfilter.html#cfn-logs-metricfilter-emitsystemfielddimensions
+        '''
+        result = self._values.get("emit_system_field_dimensions")
+        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+
+    @builtins.property
+    def field_selection_criteria(self) -> typing.Optional[builtins.str]:
+        '''The filter expression that specifies which log events are processed by this metric filter based on system fields.
+
+        Returns the ``fieldSelectionCriteria`` value if it was specified when the metric filter was created.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-metricfilter.html#cfn-logs-metricfilter-fieldselectioncriteria
+        '''
+        result = self._values.get("field_selection_criteria")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def filter_name(self) -> typing.Optional[builtins.str]:
         '''The name of the metric filter.
@@ -2547,6 +2605,8 @@ class CfnResourcePolicyProps:
         "log_group_name": "logGroupName",
         "apply_on_transformed_logs": "applyOnTransformedLogs",
         "distribution": "distribution",
+        "emit_system_fields": "emitSystemFields",
+        "field_selection_criteria": "fieldSelectionCriteria",
         "filter_name": "filterName",
         "role_arn": "roleArn",
     },
@@ -2560,6 +2620,8 @@ class CfnSubscriptionFilterProps:
         log_group_name: builtins.str,
         apply_on_transformed_logs: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         distribution: typing.Optional[builtins.str] = None,
+        emit_system_fields: typing.Optional[typing.Sequence[builtins.str]] = None,
+        field_selection_criteria: typing.Optional[builtins.str] = None,
         filter_name: typing.Optional[builtins.str] = None,
         role_arn: typing.Optional[builtins.str] = None,
     ) -> None:
@@ -2570,6 +2632,8 @@ class CfnSubscriptionFilterProps:
         :param log_group_name: The log group to associate with the subscription filter. All log events that are uploaded to this log group are filtered and delivered to the specified AWS resource if the filter pattern matches the log events.
         :param apply_on_transformed_logs: This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see `PutTransformer <https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutTransformer.html>`_ . If this value is ``true`` , the subscription filter is applied on the transformed version of the log events instead of the original ingested log events.
         :param distribution: The method used to distribute log data to the destination, which can be either random or grouped by log stream.
+        :param emit_system_fields: The list of system fields that are included in the log events sent to the subscription destination. Returns the ``emitSystemFields`` value if it was specified when the subscription filter was created.
+        :param field_selection_criteria: The filter expression that specifies which log events are processed by this subscription filter based on system fields. Returns the ``fieldSelectionCriteria`` value if it was specified when the subscription filter was created.
         :param filter_name: The name of the subscription filter.
         :param role_arn: The ARN of an IAM role that grants CloudWatch Logs permissions to deliver ingested log events to the destination stream. You don't need to provide the ARN when you are working with a logical destination for cross-account delivery.
 
@@ -2590,6 +2654,8 @@ class CfnSubscriptionFilterProps:
                 # the properties below are optional
                 apply_on_transformed_logs=False,
                 distribution="distribution",
+                emit_system_fields=["emitSystemFields"],
+                field_selection_criteria="fieldSelectionCriteria",
                 filter_name="filterName",
                 role_arn="roleArn"
             )
@@ -2601,6 +2667,8 @@ class CfnSubscriptionFilterProps:
             check_type(argname="argument log_group_name", value=log_group_name, expected_type=type_hints["log_group_name"])
             check_type(argname="argument apply_on_transformed_logs", value=apply_on_transformed_logs, expected_type=type_hints["apply_on_transformed_logs"])
             check_type(argname="argument distribution", value=distribution, expected_type=type_hints["distribution"])
+            check_type(argname="argument emit_system_fields", value=emit_system_fields, expected_type=type_hints["emit_system_fields"])
+            check_type(argname="argument field_selection_criteria", value=field_selection_criteria, expected_type=type_hints["field_selection_criteria"])
             check_type(argname="argument filter_name", value=filter_name, expected_type=type_hints["filter_name"])
             check_type(argname="argument role_arn", value=role_arn, expected_type=type_hints["role_arn"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
@@ -2612,6 +2680,10 @@ class CfnSubscriptionFilterProps:
             self._values["apply_on_transformed_logs"] = apply_on_transformed_logs
         if distribution is not None:
             self._values["distribution"] = distribution
+        if emit_system_fields is not None:
+            self._values["emit_system_fields"] = emit_system_fields
+        if field_selection_criteria is not None:
+            self._values["field_selection_criteria"] = field_selection_criteria
         if filter_name is not None:
             self._values["filter_name"] = filter_name
         if role_arn is not None:
@@ -2675,6 +2747,28 @@ class CfnSubscriptionFilterProps:
         result = self._values.get("distribution")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def emit_system_fields(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''The list of system fields that are included in the log events sent to the subscription destination.
+
+        Returns the ``emitSystemFields`` value if it was specified when the subscription filter was created.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-subscriptionfilter.html#cfn-logs-subscriptionfilter-emitsystemfields
+        '''
+        result = self._values.get("emit_system_fields")
+        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+
+    @builtins.property
+    def field_selection_criteria(self) -> typing.Optional[builtins.str]:
+        '''The filter expression that specifies which log events are processed by this subscription filter based on system fields.
+
+        Returns the ``fieldSelectionCriteria`` value if it was specified when the subscription filter was created.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-subscriptionfilter.html#cfn-logs-subscriptionfilter-fieldselectioncriteria
+        '''
+        result = self._values.get("field_selection_criteria")
+        return typing.cast(typing.Optional[builtins.str], result)
+
     @builtins.property
     def filter_name(self) -> typing.Optional[builtins.str]:
         '''The name of the subscription filter.
@@ -5541,6 +5635,7 @@ class ILogGroup(_IResourceWithPolicy_720d64fc, typing_extensions.Protocol):
         filter_pattern: IFilterPattern,
         metric_name: builtins.str,
         metric_namespace: builtins.str,
+        apply_on_transformed_logs: typing.Optional[builtins.bool] = None,
         default_value: typing.Optional[jsii.Number] = None,
         dimensions: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
         filter_name: typing.Optional[builtins.str] = None,
@@ -5553,6 +5648,7 @@ class ILogGroup(_IResourceWithPolicy_720d64fc, typing_extensions.Protocol):
         :param filter_pattern: Pattern to search for log events.
         :param metric_name: The name of the metric to emit.
         :param metric_namespace: The namespace of the metric to emit.
+        :param apply_on_transformed_logs: Whether the metric filter is applied on the tranformed logs. This parameter is valid only for log groups that have an active log transformer. If this value is true, the metric filter is applied on the transformed version of the log events instead of the original ingested log events. Default: - false
         :param default_value: The value to emit if the pattern does not match a particular event. Default: No metric emitted.
         :param dimensions: The fields to use as dimensions for the metric. One metric filter can include as many as three dimensions. Default: - No dimensions attached to metrics.
         :param filter_name: The name of the metric filter. Default: - Cloudformation generated name.
@@ -5810,6 +5906,7 @@ class _ILogGroupProxy(
         filter_pattern: IFilterPattern,
         metric_name: builtins.str,
         metric_namespace: builtins.str,
+        apply_on_transformed_logs: typing.Optional[builtins.bool] = None,
         default_value: typing.Optional[jsii.Number] = None,
         dimensions: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
         filter_name: typing.Optional[builtins.str] = None,
@@ -5822,6 +5919,7 @@ class _ILogGroupProxy(
         :param filter_pattern: Pattern to search for log events.
         :param metric_name: The name of the metric to emit.
         :param metric_namespace: The namespace of the metric to emit.
+        :param apply_on_transformed_logs: Whether the metric filter is applied on the tranformed logs. This parameter is valid only for log groups that have an active log transformer. If this value is true, the metric filter is applied on the transformed version of the log events instead of the original ingested log events. Default: - false
         :param default_value: The value to emit if the pattern does not match a particular event. Default: No metric emitted.
         :param dimensions: The fields to use as dimensions for the metric. One metric filter can include as many as three dimensions. Default: - No dimensions attached to metrics.
         :param filter_name: The name of the metric filter. Default: - Cloudformation generated name.
@@ -5835,6 +5933,7 @@ class _ILogGroupProxy(
             filter_pattern=filter_pattern,
             metric_name=metric_name,
             metric_namespace=metric_namespace,
+            apply_on_transformed_logs=apply_on_transformed_logs,
             default_value=default_value,
             dimensions=dimensions,
             filter_name=filter_name,
@@ -7308,6 +7407,7 @@ class LogGroup(
         filter_pattern: IFilterPattern,
         metric_name: builtins.str,
         metric_namespace: builtins.str,
+        apply_on_transformed_logs: typing.Optional[builtins.bool] = None,
         default_value: typing.Optional[jsii.Number] = None,
         dimensions: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
         filter_name: typing.Optional[builtins.str] = None,
@@ -7320,6 +7420,7 @@ class LogGroup(
         :param filter_pattern: Pattern to search for log events.
         :param metric_name: The name of the metric to emit.
         :param metric_namespace: The namespace of the metric to emit.
+        :param apply_on_transformed_logs: Whether the metric filter is applied on the tranformed logs. This parameter is valid only for log groups that have an active log transformer. If this value is true, the metric filter is applied on the transformed version of the log events instead of the original ingested log events. Default: - false
         :param default_value: The value to emit if the pattern does not match a particular event. Default: No metric emitted.
         :param dimensions: The fields to use as dimensions for the metric. One metric filter can include as many as three dimensions. Default: - No dimensions attached to metrics.
         :param filter_name: The name of the metric filter. Default: - Cloudformation generated name.
@@ -7333,6 +7434,7 @@ class LogGroup(
             filter_pattern=filter_pattern,
             metric_name=metric_name,
             metric_namespace=metric_namespace,
+            apply_on_transformed_logs=apply_on_transformed_logs,
             default_value=default_value,
             dimensions=dimensions,
             filter_name=filter_name,
@@ -8654,6 +8756,7 @@ class MetricFilter(
         filter_pattern: IFilterPattern,
         metric_name: builtins.str,
         metric_namespace: builtins.str,
+        apply_on_transformed_logs: typing.Optional[builtins.bool] = None,
         default_value: typing.Optional[jsii.Number] = None,
         dimensions: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
         filter_name: typing.Optional[builtins.str] = None,
@@ -8667,6 +8770,7 @@ class MetricFilter(
         :param filter_pattern: Pattern to search for log events.
         :param metric_name: The name of the metric to emit.
         :param metric_namespace: The namespace of the metric to emit.
+        :param apply_on_transformed_logs: Whether the metric filter is applied on the tranformed logs. This parameter is valid only for log groups that have an active log transformer. If this value is true, the metric filter is applied on the transformed version of the log events instead of the original ingested log events. Default: - false
         :param default_value: The value to emit if the pattern does not match a particular event. Default: No metric emitted.
         :param dimensions: The fields to use as dimensions for the metric. One metric filter can include as many as three dimensions. Default: - No dimensions attached to metrics.
         :param filter_name: The name of the metric filter. Default: - Cloudformation generated name.
@@ -8682,6 +8786,7 @@ class MetricFilter(
             filter_pattern=filter_pattern,
             metric_name=metric_name,
             metric_namespace=metric_namespace,
+            apply_on_transformed_logs=apply_on_transformed_logs,
             default_value=default_value,
             dimensions=dimensions,
             filter_name=filter_name,
@@ -8756,6 +8861,7 @@ class MetricFilter(
         "filter_pattern": "filterPattern",
         "metric_name": "metricName",
         "metric_namespace": "metricNamespace",
+        "apply_on_transformed_logs": "applyOnTransformedLogs",
         "default_value": "defaultValue",
         "dimensions": "dimensions",
         "filter_name": "filterName",
@@ -8770,6 +8876,7 @@ class MetricFilterOptions:
         filter_pattern: IFilterPattern,
         metric_name: builtins.str,
         metric_namespace: builtins.str,
+        apply_on_transformed_logs: typing.Optional[builtins.bool] = None,
         default_value: typing.Optional[jsii.Number] = None,
         dimensions: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
         filter_name: typing.Optional[builtins.str] = None,
@@ -8781,6 +8888,7 @@ class MetricFilterOptions:
         :param filter_pattern: Pattern to search for log events.
         :param metric_name: The name of the metric to emit.
         :param metric_namespace: The namespace of the metric to emit.
+        :param apply_on_transformed_logs: Whether the metric filter is applied on the tranformed logs. This parameter is valid only for log groups that have an active log transformer. If this value is true, the metric filter is applied on the transformed version of the log events instead of the original ingested log events. Default: - false
         :param default_value: The value to emit if the pattern does not match a particular event. Default: No metric emitted.
         :param dimensions: The fields to use as dimensions for the metric. One metric filter can include as many as three dimensions. Default: - No dimensions attached to metrics.
         :param filter_name: The name of the metric filter. Default: - Cloudformation generated name.
@@ -8804,6 +8912,7 @@ class MetricFilterOptions:
                 metric_namespace="metricNamespace",
             
                 # the properties below are optional
+                apply_on_transformed_logs=False,
                 default_value=123,
                 dimensions={
                     "dimensions_key": "dimensions"
@@ -8818,6 +8927,7 @@ class MetricFilterOptions:
             check_type(argname="argument filter_pattern", value=filter_pattern, expected_type=type_hints["filter_pattern"])
             check_type(argname="argument metric_name", value=metric_name, expected_type=type_hints["metric_name"])
             check_type(argname="argument metric_namespace", value=metric_namespace, expected_type=type_hints["metric_namespace"])
+            check_type(argname="argument apply_on_transformed_logs", value=apply_on_transformed_logs, expected_type=type_hints["apply_on_transformed_logs"])
             check_type(argname="argument default_value", value=default_value, expected_type=type_hints["default_value"])
             check_type(argname="argument dimensions", value=dimensions, expected_type=type_hints["dimensions"])
             check_type(argname="argument filter_name", value=filter_name, expected_type=type_hints["filter_name"])
@@ -8828,6 +8938,8 @@ class MetricFilterOptions:
             "metric_name": metric_name,
             "metric_namespace": metric_namespace,
         }
+        if apply_on_transformed_logs is not None:
+            self._values["apply_on_transformed_logs"] = apply_on_transformed_logs
         if default_value is not None:
             self._values["default_value"] = default_value
         if dimensions is not None:
@@ -8860,6 +8972,18 @@ class MetricFilterOptions:
         assert result is not None, "Required property 'metric_namespace' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def apply_on_transformed_logs(self) -> typing.Optional[builtins.bool]:
+        '''Whether the metric filter is applied on the tranformed logs.
+
+        This parameter is valid only for log groups that have an active log transformer.
+        If this value is true, the metric filter is applied on the transformed version of the log events instead of the original ingested log events.
+
+        :default: - false
+        '''
+        result = self._values.get("apply_on_transformed_logs")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
     @builtins.property
     def default_value(self) -> typing.Optional[jsii.Number]:
         '''The value to emit if the pattern does not match a particular event.
@@ -8940,6 +9064,7 @@ class MetricFilterOptions:
         "filter_pattern": "filterPattern",
         "metric_name": "metricName",
         "metric_namespace": "metricNamespace",
+        "apply_on_transformed_logs": "applyOnTransformedLogs",
         "default_value": "defaultValue",
         "dimensions": "dimensions",
         "filter_name": "filterName",
@@ -8955,6 +9080,7 @@ class MetricFilterProps(MetricFilterOptions):
         filter_pattern: IFilterPattern,
         metric_name: builtins.str,
         metric_namespace: builtins.str,
+        apply_on_transformed_logs: typing.Optional[builtins.bool] = None,
         default_value: typing.Optional[jsii.Number] = None,
         dimensions: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
         filter_name: typing.Optional[builtins.str] = None,
@@ -8967,6 +9093,7 @@ class MetricFilterProps(MetricFilterOptions):
         :param filter_pattern: Pattern to search for log events.
         :param metric_name: The name of the metric to emit.
         :param metric_namespace: The namespace of the metric to emit.
+        :param apply_on_transformed_logs: Whether the metric filter is applied on the tranformed logs. This parameter is valid only for log groups that have an active log transformer. If this value is true, the metric filter is applied on the transformed version of the log events instead of the original ingested log events. Default: - false
         :param default_value: The value to emit if the pattern does not match a particular event. Default: No metric emitted.
         :param dimensions: The fields to use as dimensions for the metric. One metric filter can include as many as three dimensions. Default: - No dimensions attached to metrics.
         :param filter_name: The name of the metric filter. Default: - Cloudformation generated name.
@@ -8993,6 +9120,7 @@ class MetricFilterProps(MetricFilterOptions):
             check_type(argname="argument filter_pattern", value=filter_pattern, expected_type=type_hints["filter_pattern"])
             check_type(argname="argument metric_name", value=metric_name, expected_type=type_hints["metric_name"])
             check_type(argname="argument metric_namespace", value=metric_namespace, expected_type=type_hints["metric_namespace"])
+            check_type(argname="argument apply_on_transformed_logs", value=apply_on_transformed_logs, expected_type=type_hints["apply_on_transformed_logs"])
             check_type(argname="argument default_value", value=default_value, expected_type=type_hints["default_value"])
             check_type(argname="argument dimensions", value=dimensions, expected_type=type_hints["dimensions"])
             check_type(argname="argument filter_name", value=filter_name, expected_type=type_hints["filter_name"])
@@ -9005,6 +9133,8 @@ class MetricFilterProps(MetricFilterOptions):
             "metric_namespace": metric_namespace,
             "log_group": log_group,
         }
+        if apply_on_transformed_logs is not None:
+            self._values["apply_on_transformed_logs"] = apply_on_transformed_logs
         if default_value is not None:
             self._values["default_value"] = default_value
         if dimensions is not None:
@@ -9037,6 +9167,18 @@ class MetricFilterProps(MetricFilterOptions):
         assert result is not None, "Required property 'metric_namespace' is missing"
         return typing.cast(builtins.str, result)
 
+    @builtins.property
+    def apply_on_transformed_logs(self) -> typing.Optional[builtins.bool]:
+        '''Whether the metric filter is applied on the tranformed logs.
+
+        This parameter is valid only for log groups that have an active log transformer.
+        If this value is true, the metric filter is applied on the transformed version of the log events instead of the original ingested log events.
+
+        :default: - false
+        '''
+        result = self._values.get("apply_on_transformed_logs")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
     @builtins.property
     def default_value(self) -> typing.Optional[jsii.Number]:
         '''The value to emit if the pattern does not match a particular event.
@@ -13126,6 +13268,7 @@ class CfnDeliveryDestination(
                 delivery_destination_name="deliveryDestinationName",
                 delivery_destination_policy=delivery_destination_policy
             ),
+            delivery_destination_type="deliveryDestinationType",
             destination_resource_arn="destinationResourceArn",
             output_format="outputFormat",
             tags=[CfnTag(
@@ -13142,6 +13285,7 @@ class CfnDeliveryDestination(
         *,
         name: builtins.str,
         delivery_destination_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnDeliveryDestination.DestinationPolicyProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
+        delivery_destination_type: typing.Optional[builtins.str] = None,
         destination_resource_arn: typing.Optional[builtins.str] = None,
         output_format: typing.Optional[builtins.str] = None,
         tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -13151,6 +13295,7 @@ class CfnDeliveryDestination(
         :param id: Construct identifier for this resource (unique in its scope).
         :param name: The name of this delivery destination.
         :param delivery_destination_policy: An IAM policy that grants permissions to CloudWatch Logs to deliver logs cross-account to a specified destination in this account. For examples of this policy, see `Examples <https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliveryDestinationPolicy.html#API_PutDeliveryDestinationPolicy_Examples>`_ in the CloudWatch Logs API Reference.
+        :param delivery_destination_type: Displays whether this delivery destination is CloudWatch Logs, Amazon S3, Firehose, or X-Ray.
         :param destination_resource_arn: The ARN of the AWS destination that this delivery destination represents. That AWS destination can be a log group in CloudWatch Logs , an Amazon S3 bucket, or a Firehose stream.
         :param output_format: The format of the logs that are sent to this delivery destination.
         :param tags: An array of key-value pairs to apply to the delivery destination. For more information, see `Tag <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html>`_ .
@@ -13162,6 +13307,7 @@ class CfnDeliveryDestination(
         props = CfnDeliveryDestinationProps(
             name=name,
             delivery_destination_policy=delivery_destination_policy,
+            delivery_destination_type=delivery_destination_type,
             destination_resource_arn=destination_resource_arn,
             output_format=output_format,
             tags=tags,
@@ -13250,15 +13396,6 @@ class CfnDeliveryDestination(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrArn"))
 
-    @builtins.property
-    @jsii.member(jsii_name="attrDeliveryDestinationType")
-    def attr_delivery_destination_type(self) -> builtins.str:
-        '''Displays whether this delivery destination is CloudWatch Logs, Amazon S3, Firehose, or X-Ray.
-
-        :cloudformationAttribute: DeliveryDestinationType
-        '''
-        return typing.cast(builtins.str, jsii.get(self, "attrDeliveryDestinationType"))
-
     @builtins.property
     @jsii.member(jsii_name="cdkTagManager")
     def cdk_tag_manager(self) -> _TagManager_0a598cb3:
@@ -13307,6 +13444,19 @@ class CfnDeliveryDestination(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "deliveryDestinationPolicy", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="deliveryDestinationType")
+    def delivery_destination_type(self) -> typing.Optional[builtins.str]:
+        '''Displays whether this delivery destination is CloudWatch Logs, Amazon S3, Firehose, or X-Ray.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "deliveryDestinationType"))
+
+    @delivery_destination_type.setter
+    def delivery_destination_type(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__e9094a474a1f0538a2e8cb2dba700e3a54dadb80fd6043cdc3c06c27ef4e0a61)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "deliveryDestinationType", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="destinationResourceArn")
     def destination_resource_arn(self) -> typing.Optional[builtins.str]:
@@ -14978,6 +15128,8 @@ class CfnMetricFilter(
         
             # the properties below are optional
             apply_on_transformed_logs=False,
+            emit_system_field_dimensions=["emitSystemFieldDimensions"],
+            field_selection_criteria="fieldSelectionCriteria",
             filter_name="filterName"
         )
     '''
@@ -14991,6 +15143,8 @@ class CfnMetricFilter(
         log_group_name: builtins.str,
         metric_transformations: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union["CfnMetricFilter.MetricTransformationProperty", typing.Dict[builtins.str, typing.Any]]]]],
         apply_on_transformed_logs: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+        emit_system_field_dimensions: typing.Optional[typing.Sequence[builtins.str]] = None,
+        field_selection_criteria: typing.Optional[builtins.str] = None,
         filter_name: typing.Optional[builtins.str] = None,
     ) -> None:
         '''
@@ -15000,6 +15154,8 @@ class CfnMetricFilter(
         :param log_group_name: The name of an existing log group that you want to associate with this metric filter.
         :param metric_transformations: The metric transformations.
         :param apply_on_transformed_logs: This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see `PutTransformer <https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutTransformer.html>`_ . If this value is ``true`` , the metric filter is applied on the transformed version of the log events instead of the original ingested log events.
+        :param emit_system_field_dimensions: The list of system fields that are emitted as additional dimensions in the generated metrics. Returns the ``emitSystemFieldDimensions`` value if it was specified when the metric filter was created.
+        :param field_selection_criteria: The filter expression that specifies which log events are processed by this metric filter based on system fields. Returns the ``fieldSelectionCriteria`` value if it was specified when the metric filter was created.
         :param filter_name: The name of the metric filter.
         '''
         if __debug__:
@@ -15011,6 +15167,8 @@ class CfnMetricFilter(
             log_group_name=log_group_name,
             metric_transformations=metric_transformations,
             apply_on_transformed_logs=apply_on_transformed_logs,
+            emit_system_field_dimensions=emit_system_field_dimensions,
+            field_selection_criteria=field_selection_criteria,
             filter_name=filter_name,
         )
 
@@ -15119,6 +15277,37 @@ class CfnMetricFilter(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "applyOnTransformedLogs", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="emitSystemFieldDimensions")
+    def emit_system_field_dimensions(
+        self,
+    ) -> typing.Optional[typing.List[builtins.str]]:
+        '''The list of system fields that are emitted as additional dimensions in the generated metrics.'''
+        return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "emitSystemFieldDimensions"))
+
+    @emit_system_field_dimensions.setter
+    def emit_system_field_dimensions(
+        self,
+        value: typing.Optional[typing.List[builtins.str]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__fb85bbbf4daaebc375fd8c7eaa366dd3b65d115ccf9913372bdd3e96861be308)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "emitSystemFieldDimensions", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="fieldSelectionCriteria")
+    def field_selection_criteria(self) -> typing.Optional[builtins.str]:
+        '''The filter expression that specifies which log events are processed by this metric filter based on system fields.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "fieldSelectionCriteria"))
+
+    @field_selection_criteria.setter
+    def field_selection_criteria(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__60d4c57a25cb5c0860f998187d0c8393e713de52986857fd0e48ce908497f0ae)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "fieldSelectionCriteria", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="filterName")
     def filter_name(self) -> typing.Optional[builtins.str]:
@@ -15695,6 +15884,8 @@ class CfnSubscriptionFilter(
             # the properties below are optional
             apply_on_transformed_logs=False,
             distribution="distribution",
+            emit_system_fields=["emitSystemFields"],
+            field_selection_criteria="fieldSelectionCriteria",
             filter_name="filterName",
             role_arn="roleArn"
         )
@@ -15710,6 +15901,8 @@ class CfnSubscriptionFilter(
         log_group_name: builtins.str,
         apply_on_transformed_logs: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
         distribution: typing.Optional[builtins.str] = None,
+        emit_system_fields: typing.Optional[typing.Sequence[builtins.str]] = None,
+        field_selection_criteria: typing.Optional[builtins.str] = None,
         filter_name: typing.Optional[builtins.str] = None,
         role_arn: typing.Optional[builtins.str] = None,
     ) -> None:
@@ -15721,6 +15914,8 @@ class CfnSubscriptionFilter(
         :param log_group_name: The log group to associate with the subscription filter. All log events that are uploaded to this log group are filtered and delivered to the specified AWS resource if the filter pattern matches the log events.
         :param apply_on_transformed_logs: This parameter is valid only for log groups that have an active log transformer. For more information about log transformers, see `PutTransformer <https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutTransformer.html>`_ . If this value is ``true`` , the subscription filter is applied on the transformed version of the log events instead of the original ingested log events.
         :param distribution: The method used to distribute log data to the destination, which can be either random or grouped by log stream.
+        :param emit_system_fields: The list of system fields that are included in the log events sent to the subscription destination. Returns the ``emitSystemFields`` value if it was specified when the subscription filter was created.
+        :param field_selection_criteria: The filter expression that specifies which log events are processed by this subscription filter based on system fields. Returns the ``fieldSelectionCriteria`` value if it was specified when the subscription filter was created.
         :param filter_name: The name of the subscription filter.
         :param role_arn: The ARN of an IAM role that grants CloudWatch Logs permissions to deliver ingested log events to the destination stream. You don't need to provide the ARN when you are working with a logical destination for cross-account delivery.
         '''
@@ -15734,6 +15929,8 @@ class CfnSubscriptionFilter(
             log_group_name=log_group_name,
             apply_on_transformed_logs=apply_on_transformed_logs,
             distribution=distribution,
+            emit_system_fields=emit_system_fields,
+            field_selection_criteria=field_selection_criteria,
             filter_name=filter_name,
             role_arn=role_arn,
         )
@@ -15851,6 +16048,35 @@ class CfnSubscriptionFilter(
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
         jsii.set(self, "distribution", value) # pyright: ignore[reportArgumentType]
 
+    @builtins.property
+    @jsii.member(jsii_name="emitSystemFields")
+    def emit_system_fields(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''The list of system fields that are included in the log events sent to the subscription destination.'''
+        return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "emitSystemFields"))
+
+    @emit_system_fields.setter
+    def emit_system_fields(
+        self,
+        value: typing.Optional[typing.List[builtins.str]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__3588fc313efd4c1adce87f72f75d7ba7f300452acb834dd4e3ecf41cded24179)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "emitSystemFields", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="fieldSelectionCriteria")
+    def field_selection_criteria(self) -> typing.Optional[builtins.str]:
+        '''The filter expression that specifies which log events are processed by this subscription filter based on system fields.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "fieldSelectionCriteria"))
+
+    @field_selection_criteria.setter
+    def field_selection_criteria(self, value: typing.Optional[builtins.str]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__cf9aef993c8f57b45189c5dbbeac65a444ff57b1cd1261310430e2c395efeab5)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "fieldSelectionCriteria", value) # pyright: ignore[reportArgumentType]
+
     @builtins.property
     @jsii.member(jsii_name="filterName")
     def filter_name(self) -> typing.Optional[builtins.str]:
@@ -19631,6 +19857,7 @@ def _typecheckingstub__53bbf04ee2b4b7e83a98258d41a973972fae20f7537731a0fbcda3e7c
     *,
     name: builtins.str,
     delivery_destination_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDeliveryDestination.DestinationPolicyProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    delivery_destination_type: typing.Optional[builtins.str] = None,
     destination_resource_arn: typing.Optional[builtins.str] = None,
     output_format: typing.Optional[builtins.str] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -19722,6 +19949,8 @@ def _typecheckingstub__524e2e94ad4843f66081953f516426a1396490f271842ac0c5ca7c7ec
     log_group_name: builtins.str,
     metric_transformations: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnMetricFilter.MetricTransformationProperty, typing.Dict[builtins.str, typing.Any]]]]],
     apply_on_transformed_logs: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    emit_system_field_dimensions: typing.Optional[typing.Sequence[builtins.str]] = None,
+    field_selection_criteria: typing.Optional[builtins.str] = None,
     filter_name: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
@@ -19752,6 +19981,8 @@ def _typecheckingstub__1250ecc947a5eb57e428cd8fedeb9ae0f6da4eb03c22d674fa019a076
     log_group_name: builtins.str,
     apply_on_transformed_logs: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     distribution: typing.Optional[builtins.str] = None,
+    emit_system_fields: typing.Optional[typing.Sequence[builtins.str]] = None,
+    field_selection_criteria: typing.Optional[builtins.str] = None,
     filter_name: typing.Optional[builtins.str] = None,
     role_arn: typing.Optional[builtins.str] = None,
 ) -> None:
@@ -19994,6 +20225,7 @@ def _typecheckingstub__5c3910e9df11478e889b7f25e252df8a33e79b82dd18c304bf83e6be6
     filter_pattern: IFilterPattern,
     metric_name: builtins.str,
     metric_namespace: builtins.str,
+    apply_on_transformed_logs: typing.Optional[builtins.bool] = None,
     default_value: typing.Optional[jsii.Number] = None,
     dimensions: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
     filter_name: typing.Optional[builtins.str] = None,
@@ -20172,6 +20404,7 @@ def _typecheckingstub__60bdb647264d5f9edd37cf7e07a8b1cde70ce81f1ebb17eb131efa9d1
     filter_pattern: IFilterPattern,
     metric_name: builtins.str,
     metric_namespace: builtins.str,
+    apply_on_transformed_logs: typing.Optional[builtins.bool] = None,
     default_value: typing.Optional[jsii.Number] = None,
     dimensions: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
     filter_name: typing.Optional[builtins.str] = None,
@@ -20368,6 +20601,7 @@ def _typecheckingstub__8d62ba20acf6180e35fd081efe9f21747bf2bd8765dd3a4a5c41cc0f4
     filter_pattern: IFilterPattern,
     metric_name: builtins.str,
     metric_namespace: builtins.str,
+    apply_on_transformed_logs: typing.Optional[builtins.bool] = None,
     default_value: typing.Optional[jsii.Number] = None,
     dimensions: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
     filter_name: typing.Optional[builtins.str] = None,
@@ -20382,6 +20616,7 @@ def _typecheckingstub__a5bb9c8220568f1b3f6adf2d20dcfde3ada18ce4351110a49b3a07078
     filter_pattern: IFilterPattern,
     metric_name: builtins.str,
     metric_namespace: builtins.str,
+    apply_on_transformed_logs: typing.Optional[builtins.bool] = None,
     default_value: typing.Optional[jsii.Number] = None,
     dimensions: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
     filter_name: typing.Optional[builtins.str] = None,
@@ -20396,6 +20631,7 @@ def _typecheckingstub__66722f3b881a30b7ce1b9efa7c76f2539915abe8fe84a770e1e2c4765
     filter_pattern: IFilterPattern,
     metric_name: builtins.str,
     metric_namespace: builtins.str,
+    apply_on_transformed_logs: typing.Optional[builtins.bool] = None,
     default_value: typing.Optional[jsii.Number] = None,
     dimensions: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
     filter_name: typing.Optional[builtins.str] = None,
@@ -20890,6 +21126,7 @@ def _typecheckingstub__b48efa0b7b05ab2d9f1417a0b1e0cd7f28039825d1520fe16f6f8dca7
     *,
     name: builtins.str,
     delivery_destination_policy: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnDeliveryDestination.DestinationPolicyProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+    delivery_destination_type: typing.Optional[builtins.str] = None,
     destination_resource_arn: typing.Optional[builtins.str] = None,
     output_format: typing.Optional[builtins.str] = None,
     tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
@@ -20937,6 +21174,12 @@ def _typecheckingstub__318bc8d97cf7e7f129b83631444b5c478bd65a7e80725c9b3be7e3cc4
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__e9094a474a1f0538a2e8cb2dba700e3a54dadb80fd6043cdc3c06c27ef4e0a61(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__831ddd5c5bd5a90cbf966f9a711dcab92a21ca60debf21106dbe34c3b30fce44(
     value: typing.Optional[builtins.str],
 ) -> None:
@@ -21360,6 +21603,8 @@ def _typecheckingstub__aaa6a2018a5f10ec1a79f547b81a628d6f434d037b49c5975131bba2d
     log_group_name: builtins.str,
     metric_transformations: typing.Union[_IResolvable_da3f097b, typing.Sequence[typing.Union[_IResolvable_da3f097b, typing.Union[CfnMetricFilter.MetricTransformationProperty, typing.Dict[builtins.str, typing.Any]]]]],
     apply_on_transformed_logs: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
+    emit_system_field_dimensions: typing.Optional[typing.Sequence[builtins.str]] = None,
+    field_selection_criteria: typing.Optional[builtins.str] = None,
     filter_name: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
@@ -21401,6 +21646,18 @@ def _typecheckingstub__ace95a6c73bb2a95ee90d8e4e4ad81a77108a607e59d44e12214965f5
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__fb85bbbf4daaebc375fd8c7eaa366dd3b65d115ccf9913372bdd3e96861be308(
+    value: typing.Optional[typing.List[builtins.str]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__60d4c57a25cb5c0860f998187d0c8393e713de52986857fd0e48ce908497f0ae(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__ed6515d6733ea675274296cf9952fb0b41bd1778277ae74bde9739d81a205382(
     value: typing.Optional[builtins.str],
 ) -> None:
@@ -21518,6 +21775,8 @@ def _typecheckingstub__6c7a154450656ee0f7e524d596c7e140faad893a71a7c8b9b8a85fe73
     log_group_name: builtins.str,
     apply_on_transformed_logs: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     distribution: typing.Optional[builtins.str] = None,
+    emit_system_fields: typing.Optional[typing.Sequence[builtins.str]] = None,
+    field_selection_criteria: typing.Optional[builtins.str] = None,
     filter_name: typing.Optional[builtins.str] = None,
     role_arn: typing.Optional[builtins.str] = None,
 ) -> None:
@@ -21566,6 +21825,18 @@ def _typecheckingstub__4730d6086a07b6e1f3b3d7251138c936aa909d17834505b0c341ec6b4
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__3588fc313efd4c1adce87f72f75d7ba7f300452acb834dd4e3ecf41cded24179(
+    value: typing.Optional[typing.List[builtins.str]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__cf9aef993c8f57b45189c5dbbeac65a444ff57b1cd1261310430e2c395efeab5(
+    value: typing.Optional[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__4ccf855abfc15a31ed667e6619b6f1711fc4ef753c64ec0b754421d81c8edb75(
     value: typing.Optional[builtins.str],
 ) -> None:
@@ -21923,3 +22194,6 @@ def _typecheckingstub__bea2654ebc88ef45acb691425a17897e52198e8f268040b952558fccd
 ) -> None:
     """Type checking stubs"""
     pass
+
+for cls in [IAccountPolicyRef, IDeliveryDestinationRef, IDeliveryRef, IDeliverySourceRef, IDestinationRef, IFilterPattern, IIntegrationRef, ILogAnomalyDetectorRef, ILogGroup, ILogGroupRef, ILogStream, ILogStreamRef, ILogSubscriptionDestination, IMetricFilterRef, IProcessor, IQueryDefinitionRef, IResourcePolicyRef, ISubscriptionFilterRef, ITransformerRef]:
+    typing.cast(typing.Any, cls).__protocol_attrs__ = typing.cast(typing.Any, cls).__protocol_attrs__ - set(['__jsii_proxy_class__', '__jsii_type__'])