This is the new *CloudFormation Template Reference Guide*. Please update your bookmarks and links. For help getting started with CloudFormation, see the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html).

# AWS::Logs::QueryDefinition
<a name="aws-resource-logs-querydefinition"></a>

Creates a query definition for CloudWatch Logs Insights. For more information, see [ Analyzing Log Data with CloudWatch Logs Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html).

## Syntax
<a name="aws-resource-logs-querydefinition-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-resource-logs-querydefinition-syntax.json"></a>

```
{
  "Type" : "AWS::Logs::QueryDefinition",
  "Properties" : {
      "[LogGroupNames](#cfn-logs-querydefinition-loggroupnames)" : [ String, ... ],
      "[Name](#cfn-logs-querydefinition-name)" : String,
      "[Parameters](#cfn-logs-querydefinition-parameters)" : [ QueryParameter, ... ],
      "[QueryLanguage](#cfn-logs-querydefinition-querylanguage)" : String,
      "[QueryString](#cfn-logs-querydefinition-querystring)" : String
    }
}
```

### YAML
<a name="aws-resource-logs-querydefinition-syntax.yaml"></a>

```
Type: AWS::Logs::QueryDefinition
Properties:
  [LogGroupNames](#cfn-logs-querydefinition-loggroupnames): 
    - String
  [Name](#cfn-logs-querydefinition-name): String
  [Parameters](#cfn-logs-querydefinition-parameters): 
    - QueryParameter
  [QueryLanguage](#cfn-logs-querydefinition-querylanguage): String
  [QueryString](#cfn-logs-querydefinition-querystring): 
    String
```

## Properties
<a name="aws-resource-logs-querydefinition-properties"></a>

`LogGroupNames`  <a name="cfn-logs-querydefinition-loggroupnames"></a>
Use this parameter if you want the query to query only certain log groups.  
*Required*: No  
*Type*: Array of String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Name`  <a name="cfn-logs-querydefinition-name"></a>
A name for the query definition.  
You can use the name to create a folder structure for your queries. To create a folder, use a forward slash (/) to prefix your desired query name with your desired folder name. For example, `folder-name/query-name`.
*Required*: Yes  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `255`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Parameters`  <a name="cfn-logs-querydefinition-parameters"></a>
If this query definition contains a list of query parameters that define placeholder variables for the query string, that list appears here.  
*Required*: No  
*Type*: Array of [QueryParameter](aws-properties-logs-querydefinition-queryparameter.md)  
*Maximum*: `20`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`QueryLanguage`  <a name="cfn-logs-querydefinition-querylanguage"></a>
The query language used for this query. For more information about the query languages that CloudWatch Logs supports, see [Supported query languages](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_Languages.html).  
*Required*: No  
*Type*: String  
*Allowed values*: `CWLI | SQL | PPL`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`QueryString`  <a name="cfn-logs-querydefinition-querystring"></a>
The query string to use for this query definition. For more information, see [CloudWatch Logs Insights Query Syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html).  
*Required*: Yes  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `10000`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

## Return values
<a name="aws-resource-logs-querydefinition-return-values"></a>

### Ref
<a name="aws-resource-logs-querydefinition-return-values-ref"></a>

When you pass the logical ID of this resource to the intrinsic `Ref` function, `Ref` returns the query definition ID.

For more information about using the `Ref` function, see [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html).

### Fn::GetAtt
<a name="aws-resource-logs-querydefinition-return-values-fn--getatt"></a>

The `Fn::GetAtt` intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the `Fn::GetAtt` intrinsic function, see [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html).

#### 
<a name="aws-resource-logs-querydefinition-return-values-fn--getatt-fn--getatt"></a>

`QueryDefinitionId`  <a name="QueryDefinitionId-fn::getatt"></a>
The ID of the query definition. 

## Examples
<a name="aws-resource-logs-querydefinition--examples"></a>

### Query definition example
<a name="aws-resource-logs-querydefinition--examples--Query_definition_example"></a>

The following example creates a query definition.

#### JSON
<a name="aws-resource-logs-querydefinition--examples--Query_definition_example--json"></a>

```
"myQueryDefinition": {
  "Type": "AWS::Logs::QueryDefinition",
  "Properties": {
    "Name": "myQueryName",
    "QueryString": "fields @timestamp, @message | sort @timestamp desc | limit 20"
    }
}
```

#### YAML
<a name="aws-resource-logs-querydefinition--examples--Query_definition_example--yaml"></a>

```
myQueryDefinition:
  Type: AWS::Logs::QueryDefinition
  Properties:
    Name: "myQueryName"
    QueryString: “fields @timestamp, @message | sort @timestamp desc | limit 20"
```

# AWS::Logs::QueryDefinition QueryParameter
<a name="aws-properties-logs-querydefinition-queryparameter"></a>

This structure defines a query parameter for a saved CloudWatch Logs Insights query definition. Query parameters are supported only for Logs Insights QL queries. They are placeholder variables that you can reference in a query string using the `{{parameterName}}` syntax. Each parameter can include a default value and a description.

## Syntax
<a name="aws-properties-logs-querydefinition-queryparameter-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-logs-querydefinition-queryparameter-syntax.json"></a>

```
{
  "[DefaultValue](#cfn-logs-querydefinition-queryparameter-defaultvalue)" : String,
  "[Description](#cfn-logs-querydefinition-queryparameter-description)" : String,
  "[Name](#cfn-logs-querydefinition-queryparameter-name)" : String
}
```

### YAML
<a name="aws-properties-logs-querydefinition-queryparameter-syntax.yaml"></a>

```
  [DefaultValue](#cfn-logs-querydefinition-queryparameter-defaultvalue): String
  [Description](#cfn-logs-querydefinition-queryparameter-description): String
  [Name](#cfn-logs-querydefinition-queryparameter-name): String
```

## Properties
<a name="aws-properties-logs-querydefinition-queryparameter-properties"></a>

`DefaultValue`  <a name="cfn-logs-querydefinition-queryparameter-defaultvalue"></a>
The default value to use for this query parameter if no value is supplied at execution time.  
*Required*: No  
*Type*: String  
*Maximum*: `1024`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Description`  <a name="cfn-logs-querydefinition-queryparameter-description"></a>
A description of the query parameter that explains its purpose or expected values.  
*Required*: No  
*Type*: String  
*Maximum*: `512`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Name`  <a name="cfn-logs-querydefinition-queryparameter-name"></a>
The name of the query parameter. A query parameter name must start with a letter or underscore, and contain only letters, digits, and underscores.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^[a-zA-Z_][a-zA-Z0-9_]*$`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)