Get Query Results

cloudwatchlogs_get_query_results

R Documentation

Returns the results from the specified query

Description

Returns the results from the specified query.

Only the fields requested in the query are returned, along with a ⁠@ptr⁠ field, which is the identifier for the log record. You can use the value of ⁠@ptr⁠ in a get_log_record operation to get the full log record.

get_query_results does not start running a query. To run a query, use start_query. For more information about how long results of previous queries are available, see CloudWatch Logs quotas.

If the value of the Status field in the output is Running, this operation returns only partial results. If you see a value of Scheduled or Running for the status, you can retry the operation later to see the final results.

This operation is used both for retrieving results from interactive queries and from automated scheduled query executions. Scheduled queries use get_query_results internally to retrieve query results for processing and delivery to configured destinations.

You can retrieve up to 100,000 log event results from a query, if available, by using pagination. Use the nextToken returned in the response to request additional pages of results, with each page returning up to 10,000 log events.

If you are using CloudWatch cross-account observability, you can use this operation in a monitoring account to start queries in linked source accounts. For more information, see CloudWatch cross-account observability.

Usage

cloudwatchlogs_get_query_results(queryId, nextToken, maxItems)

Arguments

queryId	[required] The ID number of the query.
nextToken	The token for the next set of items to return. The token expires after 1 hour.
maxItems	The maximum number of log events to return in the response. The maximum is 10,000 log events per request. You can retrieve up to 100,000 log event results from a query by paginating with the nextToken.

Value

A list with the following syntax:

list(
  queryLanguage = "CWLI"|"SQL"|"PPL",
  results = list(
    list(
      list(
        field = "string",
        value = "string"
      )
    )
  ),
  statistics = list(
    recordsMatched = 123.0,
    recordsScanned = 123.0,
    estimatedRecordsSkipped = 123.0,
    bytesScanned = 123.0,
    estimatedBytesSkipped = 123.0,
    logGroupsScanned = 123.0
  ),
  status = "Scheduled"|"Running"|"Complete"|"Failed"|"Cancelled"|"Timeout"|"Unknown",
  encryptionKey = "string",
  nextToken = "string"
)

Request syntax

svc$get_query_results(
  queryId = "string",
  nextToken = "string",
  maxItems = 123
)