AWS AmazonCloudWatch documentation change
Summary
Updated syntax and examples for CloudWatch Logs Insights lookup command, including simplified field matching
Security assessment
The changes are purely syntax improvements and query examples for log analysis. No security features, vulnerabilities, or security-related contexts are mentioned in the diff.
Diff
diff --git a/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Lookup.md b/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Lookup.md index 42f469b6a..41f913c54 100644 --- a//AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Lookup.md +++ b//AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Lookup.md @@ -61 +61 @@ The following shows the format of this command. - lookup table lookup-field as log-field [,...] output-mode output-field[,...] + lookup table match-fields output-mode output-field[,...] @@ -67 +67 @@ The command uses the following arguments: - * ``lookup-field`` – The field in the lookup table to match against. + * ``match-fields`` – Specify one or more fields to match log events against the lookup table. You can use either of the following forms: @@ -69 +69 @@ The command uses the following arguments: - * ``log-field`` – The field in your log events to match. The match is exact and case-sensitive. + * ``lookup-field` as `log-field` [,...]` – Use `as` when the lookup table column name differs from the log event field name. For example, `ip_address as srcAddr` matches the `ip_address` column in the lookup table against the `srcAddr` field in your log events. @@ -71 +71,3 @@ The command uses the following arguments: - * ``lookup-field` as `log-field` [,...]` – You can specify multiple match field pairs separated by commas. When multiple pairs are specified, a row in the lookup table must match all fields to produce a result (AND logic). + * ``lookup-field` [,...]` – When the log event field name is the same as the lookup table column name, you can omit `as` and specify the field name directly. For example, `department, role` matches both columns against log event fields with the same names. + +When multiple match fields are specified, a row in the lookup table must match all fields to produce a result (AND logic). @@ -126,0 +129,8 @@ You can match on more than one field. The following query matches both `srcAddr` +###### Example: Use lookup with matching field names + +When your log event field names match the lookup table column names exactly, you can omit the `as` keyword. The following query matches both `department` and `role` fields directly against the lookup table. + + + fields @timestamp, department, role + | lookup employees department, role OUTPUT office, manager +