indexCategories

The index categories to return. The following values are supported:

• DEFAULT: Fields that CloudWatch Logs indexes by default. Examples include @logStream and @data_format.

• CUSTOM: Fields that you added manually to the field index policy. CloudWatch Logs always indexes these fields. These fields count toward the quota of 20 fields for each log group.

• AUTO: Fields that CloudWatch Logs indexes automatically based on your query patterns and usage. These fields do not count toward the field index quota. CloudWatch Logs might update these fields based on changes in your query patterns. To keep a field indexed permanently, add it to an account-level or log-group level field index policy.

• INACTIVE: Fields that CloudWatch Logs indexed before but does not index now. This happens if you remove a field from the field index policy or if CloudWatch Logs automatically selects a different field based on your queries.

If you omit this parameter, the response includes the DEFAULT, CUSTOM, and INACTIVE categories.

For more information about automatically indexed fields and using the AUTO category, see Automatically indexed fields.