View a markdown version of this page

AWS::CloudWatch::LogAlarm - AWS CloudFormation
SyntaxPropertiesReturn values

This is the new CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the AWS CloudFormation User Guide.

AWS::CloudWatch::LogAlarm

Creates or updates a log alarm. A log alarm evaluates the results of a CloudWatch Logs scheduled query against the configured threshold and comparison operator to determine its state.

When you create a log alarm, the operation creates a service-managed CloudWatch Logs scheduled query that runs the query string you provide on the schedule you configure. Each scheduled query execution returns one or more aggregated values determined by the AggregationExpression, and each aggregated value is compared against the alarm Threshold to determine the alarm state. The alarm uses M-out-of-N evaluation: if QueryResultsToAlarm out of the most recent QueryResultsToEvaluate query results breach the threshold, the alarm transitions to ALARM.

Log alarms support the alarm states (OK, ALARM, INSUFFICIENT_DATA). Configure transition actions using OKActions, AlarmActions, and InsufficientDataActions.

If you call this operation with the name of an existing log alarm, the operation replaces the previous configuration of that alarm.

Permissions

To create or update a log alarm, you must have the cloudwatch:PutLogAlarm permission. The IAM role specified in ScheduledQueryRoleARN must grant the CloudWatch Alarms service permission to execute scheduled queries on the specified log groups. If you set ActionLogLineCount, the role specified in ActionLogLineRoleArn must grant permission to retrieve log events for inclusion in alarm notifications.

Syntax

To declare this entity in your CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::CloudWatch::LogAlarm",
  "Properties" : {
      "ActionLogLineCount" : Integer,
      "ActionLogLineRoleArn" : String,
      "ActionsEnabled" : Boolean,
      "AlarmActions" : [ String, ... ],
      "AlarmDescription" : String,
      "AlarmName" : String,
      "ComparisonOperator" : String,
      "InsufficientDataActions" : [ String, ... ],
      "OKActions" : [ String, ... ],
      "QueryResultsToAlarm" : Integer,
      "QueryResultsToEvaluate" : Integer,
      "ScheduledQueryConfiguration" : ScheduledQueryConfiguration,
      "Tags" : [ Tag, ... ],
      "Threshold" : Number,
      "TreatMissingData" : String
    }
}

YAML

Type: AWS::CloudWatch::LogAlarm
Properties:
  ActionLogLineCount: Integer
  ActionLogLineRoleArn: String
  ActionsEnabled: Boolean
  AlarmActions: 
    - String
  AlarmDescription: String
  AlarmName: String
  ComparisonOperator: String
  InsufficientDataActions: 
    - String
  OKActions: 
    - String
  QueryResultsToAlarm: Integer
  QueryResultsToEvaluate: Integer
  ScheduledQueryConfiguration: 
    ScheduledQueryConfiguration
  Tags: 
    - Tag
  Threshold: Number
  TreatMissingData: String

Properties

ActionLogLineCount

The number of log lines from the most recent scheduled query execution that are included in alarm action notifications. Valid range is 0 through 50. A value of 0 means no log lines are included.

Required: No

Type: Integer

Minimum: 0

Maximum: 50

Update requires: No interruption

ActionLogLineRoleArn

The Amazon Resource Name (ARN) of the IAM role that CloudWatch assumes to retrieve log events for inclusion in alarm action notifications. Set when ActionLogLineCount is greater than 0.

Required: No

Type: String

Update requires: No interruption

ActionsEnabled

Indicates whether actions should be executed during any changes to the alarm state.

Required: No

Type: Boolean

Update requires: No interruption

AlarmActions

The actions to execute when this alarm transitions to the ALARM state from any other state. Each action is specified as an Amazon Resource Name (ARN).

Required: No

Type: Array of String

Update requires: No interruption

AlarmDescription

The description of the alarm.

Required: No

Type: String

Update requires: No interruption

AlarmName

The name of the alarm.

Required: No

Type: String

Minimum: 1

Maximum: 255

Update requires: Replacement

ComparisonOperator

The arithmetic operation to use when comparing the aggregated query result and the threshold. The aggregated query result is used as the first operand.

Required: Yes

Type: String

Update requires: No interruption

InsufficientDataActions

The actions to execute when this alarm transitions to the INSUFFICIENT_DATA state from any other state. Each action is specified as an Amazon Resource Name (ARN).

Required: No

Type: Array of String

Update requires: No interruption

OKActions

The actions to execute when this alarm transitions to the OK state from any other state. Each action is specified as an Amazon Resource Name (ARN).

Required: No

Type: Array of String

Update requires: No interruption

QueryResultsToAlarm

The number of query results, out of the most recent QueryResultsToEvaluate results, that must breach the threshold to trigger the alarm to transition to ALARM (the M in M-of-N evaluation).

Required: Yes

Type: Integer

Update requires: No interruption

QueryResultsToEvaluate

The number of most recent scheduled query results that the alarm evaluates against the threshold (the N in M-of-N evaluation).

Required: Yes

Type: Integer

Update requires: No interruption

ScheduledQueryConfiguration

The configuration of the underlying CloudWatch Logs scheduled query, including the query string, log groups, schedule, aggregation expression, and the ARN of the managed scheduled query.

Required: Yes

Type: ScheduledQueryConfiguration

Update requires: No interruption

Tags

Property description not available.

Required: No

Type: Array of Tag

Maximum: 50

Update requires: No interruption

Threshold

The value to compare with the aggregated query result.

Required: Yes

Type: Number

Update requires: No interruption

TreatMissingData

How this alarm handles missing data points. Valid values are breaching, notBreaching, ignore, and missing.

Required: No

Type: String

Update requires: No interruption

Return values

Ref

Fn::GetAtt

Arn

Property description not available.