CloudWatch Logs Now Auto-Indexes Your Most-Queried Fields, No Setup Needed!

Hi, it's Shii-chan!

AWS What's New aws.amazon.com

I found a nice CloudWatch Logs update today, so let me share it with you!

What was announced?

According to AWS What's New, Amazon CloudWatch Logs now automatically indexes the fields you query frequently.

CloudWatch Logs looks at the fields you filter on with the = and IN operations in Logs Insights queries and indexes them for you. Queries run faster and scan less data.

The story so far

Before, you had to choose which fields to index yourself, based on your query patterns and usage.

That meant extra work for teams whose query patterns change over time.

What changes

Indexes now follow your everyday queries without any setup!

• No more picking fields by hand
• The list of automatically indexed fields updates as your query patterns change
• It comes at no additional cost

If you search logs a lot, things get faster without you doing anything.

Dive Deep

Here are the details from the announcement.

• Automatically indexed fields don't count toward the 20-field-per-log-group limit
• Automatic indexes are retained for 30 days
• Fields used for filtering with = and IN are eligible
• To keep a field indexed permanently, promote it to a field index policy in the console or API
• Available in all AWS Regions where CloudWatch Logs field indexing is supported
• No additional cost

Wrap-up

• Frequently queried fields are indexed automatically
• Logs Insights queries run faster and scan less data
• Automatic indexes don't use up the 20-field limit
• You can promote fields you want to keep to a policy

This is great for ops teams tired of maintaining log search settings!