Amazon CloudWatch Logs

2026/04/03 - Amazon CloudWatch Logs - 1 updated api methods

Changes  Added queryDuration, bytesScanned, and userIdentity fields to the QueryInfo response object returned by DescribeQueries. Customers can now view detailed query cost information including who ran the query, how long it took, and the volume of data scanned.

DescribeQueries (updated) Link ΒΆ
Changes (response)
{'queries': {'bytesScanned': 'double',
             'queryDuration': 'long',
             'userIdentity': 'string'}}

Returns a list of CloudWatch Logs Insights queries that are scheduled, running, or have been run recently in this account. You can request all queries or limit it to queries of a specific log group or queries with a certain status.

This operation includes both interactive queries started directly by users and automated queries executed by scheduled query configurations. Scheduled query executions appear in the results alongside manually initiated queries, providing visibility into all query activity in your account.

See also: AWS API Documentation

Request Syntax

client.describe_queries(
    logGroupName='string',
    status='Scheduled'|'Running'|'Complete'|'Failed'|'Cancelled'|'Timeout'|'Unknown',
    maxResults=123,
    nextToken='string',
    queryLanguage='CWLI'|'SQL'|'PPL'
)
type logGroupName:

string

param logGroupName:

Limits the returned queries to only those for the specified log group.

type status:

string

param status:

Limits the returned queries to only those that have the specified status. Valid values are Cancelled, Complete, Failed, Running, and Scheduled.

type maxResults:

integer

param maxResults:

Limits the number of returned queries to the specified number.

type nextToken:

string

param nextToken:

The token for the next set of items to return. The token expires after 24 hours.

type queryLanguage:

string

param queryLanguage:

Limits the returned queries to only the queries that use the specified query language.

rtype:

dict

returns:

Response Syntax

{
    'queries': [
        {
            'queryLanguage': 'CWLI'|'SQL'|'PPL',
            'queryId': 'string',
            'queryString': 'string',
            'status': 'Scheduled'|'Running'|'Complete'|'Failed'|'Cancelled'|'Timeout'|'Unknown',
            'createTime': 123,
            'logGroupName': 'string',
            'queryDuration': 123,
            'bytesScanned': 123.0,
            'userIdentity': 'string'
        },
    ],
    'nextToken': 'string'
}

Response Structure

  • (dict) --

    • queries (list) --

      The list of queries that match the request.

      • (dict) --

        Information about one CloudWatch Logs Insights query that matches the request in a DescribeQueries operation.

        • queryLanguage (string) --

          The query language used for this query. For more information about the query languages that CloudWatch Logs supports, see Supported query languages.

        • queryId (string) --

          The unique ID number of this query.

        • queryString (string) --

          The query string used in this query.

        • status (string) --

          The status of this query. Possible values are Cancelled, Complete, Failed, Running, Scheduled, and Unknown.

        • createTime (integer) --

          The date and time that this query was created.

        • logGroupName (string) --

          The name of the log group scanned by this query.

        • queryDuration (integer) --

          The duration in milliseconds that the query took to execute.

        • bytesScanned (float) --

          The total number of bytes scanned by the query. This indicates the cost associated with the query.

        • userIdentity (string) --

          The ARN of the user who ran the query.

    • nextToken (string) --

      The token for the next set of items to return. The token expires after 24 hours.