Returns the results from the specified query.
Only the fields requested in the query are returned, along with a
@ptr field, which is the identifier for the log record. You can use the value of
@ptr in a
GetLogRecord operation to get the full log record.
GetQueryResults does not start running a query. To run a query, use
StartQuery. For more information about how long results of previous queries are available, see
CloudWatch Logs quotas.
If the value of the
Status field in the output is
Running, this operation returns only partial results. If you see a value of
Scheduled or
Running for the status, you can retry the operation later to see the final results.
This operation is used both for retrieving results from interactive queries and from automated scheduled query executions. Scheduled queries use
GetQueryResults internally to retrieve query results for processing and delivery to configured destinations.
You can retrieve up to 100,000 log event results from a query, if available, by using pagination. Use the
nextToken returned in the response to request additional pages of results, with each page returning up to 10,000 log events.
If you are using CloudWatch cross-account observability, you can use this operation in a monitoring account to start queries in linked source accounts. For more information, see
CloudWatch cross-account observability.
This cmdlet automatically pages all available results to the pipeline - parameters related to iteration are only needed if you want to manually control the paginated output. To disable autopagination, use -NoAutoIteration.