AWS AmazonCloudWatch documentation change
Summary
Added detailed comparison between filterIndex and filter commands with examples
Security assessment
Technical documentation improvement about query performance characteristics, no security implications mentioned
Diff
diff --git a/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-FilterIndex.md b/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-FilterIndex.md index f2427403d..3d14f4d93 100644 --- a//AmazonCloudWatch/latest/logs/CWL_QuerySyntax-FilterIndex.md +++ b//AmazonCloudWatch/latest/logs/CWL_QuerySyntax-FilterIndex.md @@ -4,0 +5,2 @@ +filterIndex compared to filter + @@ -41,0 +44,16 @@ Default field indexes are in addition to any custom field indexes you define wit +## filterIndex compared to filter + +To illustrate the difference between `filterIndex` and `filter`, consider the following example queries. Assume that you have created a field index for `IPaddress`, for four of your log groups, but not for a fifth log group. The following query using `filterIndex` will skip scanning the log group that doesn't have the field indexed. For each indexed log group, it attempts to scan only log events that have the indexed field, and it also returns only results from after the field index was created. + + + fields @timestamp, @message + | filterIndex IPaddress = "198.51.100.0" + | limit 20 + +In contrast, if you use `filter` instead of `filterIndex` for a query of the same five log groups, the query will attempt to scan not only the log events that contain the value in the indexed log groups, but will also scan the fifth log group that isn't indexed, and it will scan every log event in that fifth log group. + + + fields @timestamp, @message + | filter IPaddress = "198.51.100.0" + | limit 20 + @@ -50 +68 @@ filter -filterIndex compared to filter +SOURCE