AWS AmazonCloudWatch documentation change
Summary
Added documentation for new PPL query commands (join, subquery, cidrmatch, JSON functions) and expanded existing syntax examples
Security assessment
The addition of `cidrmatch` function documentation relates to IP address filtering, which can be used for security log analysis. However, this is a feature enhancement rather than a vulnerability fix.
Diff
diff --git a/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_PPL.md b/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_PPL.md index ef445b381..1d7ffafc8 100644 --- a//AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_PPL.md +++ b//AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_PPL.md @@ -9 +9,3 @@ This section contains a basic introduction to querying CloudWatch Logs using Ope -You can use OpenSearch PPL only for queries of log groups in the Standard Log Class. +You can use OpenSearch PPL only for queries of log groups in the Standard Log Class. When you select which log groups to query, you can select a single log group, a set of log groups that share a prefix, or select all log groups + +###### Note @@ -15,0 +18 @@ fields | `fields field1, field2` | Displays a set of fields which needs projec +join | `LEFT JOIN left=l, right=r on l.id = r.id `join_right_lg` | fields l.field_1, r.field_2` | Joins two datasets together. @@ -25,0 +29 @@ rare | `rare field1 by field2` | Finds the least frequent values of all fields +subquery | `where field_1 IN [ search source= `subquery_lg` | fields field_2 ] | fields id, field_1 ` | Performs complex, nested queries within your PPL statements. @@ -27,0 +32,4 @@ eventStats | `eventstats sum(field1) by field2` | Enriches your event data wit +expand | `eval tags_array_string = json_extract(`@message`, '$.tags')| eval tags_array = json_array(json_extract(tags_string, '$[0]'), json_extract(tags_string, '$[1]'))| expand tags_array as color_tags` | Breaks down a field containing multiple values into separate rows, creating a new row for each value in the specified field. +fillnull | `fields `@timestamp`, error_code, status_code | fillnull using status_code = "UNKNOWN", error_code = "UNKNOWN"` | Fills null fields with the value that you provide. It can be used in one or more fields. +flatten | `eval metadata_struct = json_object('size', json_extract(metadata_string, '$.size'), 'color', json_extract(metadata_string, '$.color')) | flatten metadata_struct as (meta_size, meta_color) ` | Flattens a field. The field must be of this type: `struct<?,?>` or `array<struct<?,?>>`. +cidrmatch | `where cidrmatch(ip, '2003:db8::/32') | fields ip ` | Checks if the specified IP address is within the given CIDR range. @@ -31,2 +39 @@ String functions | `eval field1Len = LENGTH(field1) | fields field1Len` | Buil -Math functions | `eval field2 = ACOS(field1) | fields field1` | Built-in functions for performing mathematical calculations and transformations in PPL queries. For example, abs (absolute value), round (rounds numbers), sqrt (square root), pow (power calculation), and ceil (rounds up to nearest integer). -Date functions | `eval newDate = ADDDATE(DATE('2020-08-26'), 1) | fields newDate ` | Built-in functions for handling and transforming date and timestamp data in PPL queries. For example, date_add, date_format, datediff, and current_date. +Date-Time functions | `eval newDate = ADDDATE(DATE('2020-08-26'), 1) | fields newDate ` | Built-in functions for handling and transforming date and timestamp data in PPL queries. For example, date_add, date_format, datediff, date-sub, timestampadd, timestampdiff, current_timezone, utc_timestamp, and current_date. @@ -35,0 +43 @@ CryptoGraphic functions | `eval crypto = MD5(field)| head 1000` | To calculate +JSON functions | `eval valid_json = json('[1,2,3,{"f1":1,"f2":[5,6]},4]') | fields valid_json` | Built-in functions for handling JSON including arrays, extracting, and validation. For example, json_object, json_array, to_json_string, json_array_length, json_extract, json_keys, and json_valid.