PUTINSIGHTSELECTORS()`¶

About PutInsightSelectors¶

Lets you enable Insights event logging on specific event categories by specifying the Insights selectors that you want to enable on an existing trail or event data store. You also use PutInsightSelectors to turn off Insights event logging, by passing an empty list of Insights types. The valid Insights event types are ApiErrorRateInsight and ApiCallRateInsight, and valid EventCategories are Management and Data.

Insights on data events are not supported on event data stores. For event data stores, you can only enable Insights on management events.

To enable Insights on an event data store, you must specify the ARNs (or ID suffix of the ARNs) for the source event data store (EventDataStore) and the destination event data store (InsightsDestination). The source event data store logs management events and enables Insights. The destination event data store logs Insights events based upon the management event activity of the source event data store. The source and destination event data stores must belong to the same Amazon Web Services account.

To log Insights events for a trail, you must specify the name (TrailName) of the CloudTrail trail for which you want to change or add Insights selectors.

For Management events Insights: To log CloudTrail Insights on the API call rate, the trail or event data store must log write management events. To log CloudTrail Insights on the API error rate, the trail or event data store must log read or write management events.
For Data events Insights: To log CloudTrail Insights on the API call rate or API error rate, the trail must log read or write data events. Data events Insights are not supported on event data store.

To log CloudTrail Insights events on API call volume, the trail or event data store must log write management events. To log CloudTrail Insights events on API error rate, the trail or event data store must log read or write management events. You can call GetEventSelectors on a trail to check whether the trail logs management events. You can call GetEventDataStore on an event data store to check whether the event data store logs management events.

For more information, see Working with CloudTrail Insights in the CloudTrail User Guide.

Method Signature¶

METHODS /AWS1/IF_TRL~PUTINSIGHTSELECTORS
  IMPORTING
    !IV_TRAILNAME TYPE /AWS1/TRLSTRING OPTIONAL
    !IT_INSIGHTSELECTORS TYPE /AWS1/CL_TRLINSIGHTSELECTOR=>TT_INSIGHTSELECTORS OPTIONAL
    !IV_EVENTDATASTORE TYPE /AWS1/TRLEVENTDATASTOREARN OPTIONAL
    !IV_INSIGHTSDESTINATION TYPE /AWS1/TRLEVENTDATASTOREARN OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_trlputinsightselors01
  RAISING
    /AWS1/CX_TRLCLOUDTRAILARNINVEX
    /AWS1/CX_TRLINSUFFICIENTENCP00
    /AWS1/CX_TRLINSUFFICIENTS3BK00
    /AWS1/CX_TRLINVHOMEREGIONEX
    /AWS1/CX_TRLINVINSIGHTSELORSEX
    /AWS1/CX_TRLINVPRMCOMBINATIO00
    /AWS1/CX_TRLINVALIDPARAMETEREX
    /AWS1/CX_TRLINVALIDTRAILNAMEEX
    /AWS1/CX_TRLKMSEXCEPTION
    /AWS1/CX_TRLNOMANAGEMENTACCT00
    /AWS1/CX_TRLNOTORGMASTERACCTEX
    /AWS1/CX_TRLOPNOTPERMITTEDEX
    /AWS1/CX_TRLS3BKTDOESNOTEXEX
    /AWS1/CX_TRLTHROTTLINGEX
    /AWS1/CX_TRLTRAILNOTFOUNDEX
    /AWS1/CX_TRLUNSUPPORTEDOPEX
    /AWS1/CX_TRLCLIENTEXC
    /AWS1/CX_TRLSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING¶

Required arguments:¶

`it_insightselectors` `TYPE /AWS1/CL_TRLINSIGHTSELECTOR=>TT_INSIGHTSELECTORS` `TT_INSIGHTSELECTORS`¶

Contains the Insights types you want to log on a specific category of events on a trail or event data store. ApiCallRateInsight and ApiErrorRateInsight are valid Insight types.The EventCategory field can specify Management or Data events or both. For event data store, you can log Insights for management events only.

The ApiCallRateInsight Insights type analyzes write-only management API calls or read and write data API calls that are aggregated per minute against a baseline API call volume.

The ApiErrorRateInsight Insights type analyzes management and data API calls that result in error codes. The error is shown if the API call is unsuccessful.

Optional arguments:¶

`iv_trailname` `TYPE /AWS1/TRLSTRING` `/AWS1/TRLSTRING`¶

The name of the CloudTrail trail for which you want to change or add Insights selectors.

You cannot use this parameter with the EventDataStore and InsightsDestination parameters.

`iv_eventdatastore` `TYPE /AWS1/TRLEVENTDATASTOREARN` `/AWS1/TRLEVENTDATASTOREARN`¶

The ARN (or ID suffix of the ARN) of the source event data store for which you want to change or add Insights selectors. To enable Insights on an event data store, you must provide both the EventDataStore and InsightsDestination parameters.

You cannot use this parameter with the TrailName parameter.

`iv_insightsdestination` `TYPE /AWS1/TRLEVENTDATASTOREARN` `/AWS1/TRLEVENTDATASTOREARN`¶

The ARN (or ID suffix of the ARN) of the destination event data store that logs Insights events. To enable Insights on an event data store, you must provide both the EventDataStore and InsightsDestination parameters.

You cannot use this parameter with the TrailName parameter.

RETURNING¶

`oo_output` `TYPE REF TO /aws1/cl_trlputinsightselors01` `/AWS1/CL_TRLPUTINSIGHTSELORS01`¶

Domain /AWS1/RT_ACCOUNT_ID

Primitive Type NUMC

Examples¶

Syntax Example¶

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->putinsightselectors(
  it_insightselectors = VALUE /aws1/cl_trlinsightselector=>tt_insightselectors(
    (
      new /aws1/cl_trlinsightselector(
        it_eventcategories = VALUE /aws1/cl_trlsourceeventcats_w=>tt_sourceeventcategories(
          ( new /aws1/cl_trlsourceeventcats_w( |string| ) )
        )
        iv_insighttype = |string|
      )
    )
  )
  iv_eventdatastore = |string|
  iv_insightsdestination = |string|
  iv_trailname = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  lv_string = lo_result->get_trailarn( ).
  LOOP AT lo_result->get_insightselectors( ) into lo_row.
    lo_row_1 = lo_row.
    IF lo_row_1 IS NOT INITIAL.
      lv_insighttype = lo_row_1->get_insighttype( ).
      LOOP AT lo_row_1->get_eventcategories( ) into lo_row_2.
        lo_row_3 = lo_row_2.
        IF lo_row_3 IS NOT INITIAL.
          lv_sourceeventcategory = lo_row_3->get_value( ).
        ENDIF.
      ENDLOOP.
    ENDIF.
  ENDLOOP.
  lv_eventdatastorearn = lo_result->get_eventdatastorearn( ).
  lv_eventdatastorearn = lo_result->get_insightsdestination( ).
ENDIF.

/AWS1/IF_TRL=>PUTINSIGHTSELECTORS()¶