Struct Anomaly

#[non_exhaustive]
pub struct Anomaly {

    pub anomaly_id: String,
    pub pattern_id: String,
    pub anomaly_detector_arn: String,
    pub pattern_string: String,
    pub pattern_regex: Option<String>,
    pub priority: Option<String>,
    pub first_seen: i64,
    pub last_seen: i64,
    pub description: String,
    pub active: bool,
    pub state: State,
    pub histogram: HashMap<String, i64>,
    pub log_samples: Vec<LogEvent>,
    pub pattern_tokens: Vec<PatternToken>,
    pub log_group_arn_list: Vec<String>,
    pub suppressed: Option<bool>,
    pub suppressed_date: i64,
    pub suppressed_until: i64,
    pub is_pattern_level_suppression: Option<bool>,
}

This structure represents one anomaly that has been found by a logs anomaly detector.

For more information about patterns and anomalies, see CreateLogAnomalyDetector.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

anomaly_id: String

The unique ID that CloudWatch Logs assigned to this anomaly.

pattern_id: String

The ID of the pattern used to help identify this anomaly.

anomaly_detector_arn: String

The ARN of the anomaly detector that identified this anomaly.

pattern_string: String

The pattern used to help identify this anomaly, in string format.

pattern_regex: Option<String>

The pattern used to help identify this anomaly, in regular expression format.

priority: Option<String>

The priority level of this anomaly, as determined by CloudWatch Logs. Priority is computed based on log severity labels such as FATAL and ERROR and the amount of deviation from the baseline. Possible values are HIGH, MEDIUM, and LOW.

first_seen: i64

The date and time when the anomaly detector first saw this anomaly. It is specified as epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.

last_seen: i64

The date and time when the anomaly detector most recently saw this anomaly. It is specified as epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.

description: String

A human-readable description of the anomaly. This description is generated by CloudWatch Logs.

active: bool

Specifies whether this anomaly is still ongoing.

state: State

Indicates the current state of this anomaly. If it is still being treated as an anomaly, the value is Active. If you have suppressed this anomaly by using the UpdateAnomaly operation, the value is Suppressed. If this behavior is now considered to be normal, the value is Baseline.

histogram: HashMap<String, i64>

A map showing times when the anomaly detector ran, and the number of occurrences of this anomaly that were detected at each of those runs. The times are specified in epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.

log_samples: Vec<LogEvent>

An array of sample log event messages that are considered to be part of this anomaly.

pattern_tokens: Vec<PatternToken>

An array of structures where each structure contains information about one token that makes up the pattern.

log_group_arn_list: Vec<String>

An array of ARNS of the log groups that contained log events considered to be part of this anomaly.

suppressed: Option<bool>

Indicates whether this anomaly is currently suppressed. To suppress an anomaly, use UpdateAnomaly.

suppressed_date: i64

If the anomaly is suppressed, this indicates when it was suppressed.

suppressed_until: i64

If the anomaly is suppressed, this indicates when the suppression will end. If this value is 0, the anomaly was suppressed with no expiration, with the INFINITE value.

is_pattern_level_suppression: Option<bool>

If this anomaly is suppressed, this field is true if the suppression is because the pattern is suppressed. If false, then only this particular anomaly is suppressed.

Implementations

impl Anomaly

pub fn anomaly_id(&self) -> &str

The unique ID that CloudWatch Logs assigned to this anomaly.

pub fn pattern_id(&self) -> &str

The ID of the pattern used to help identify this anomaly.

pub fn anomaly_detector_arn(&self) -> &str

The ARN of the anomaly detector that identified this anomaly.

pub fn pattern_string(&self) -> &str

The pattern used to help identify this anomaly, in string format.

pub fn pattern_regex(&self) -> Option<&str>

The pattern used to help identify this anomaly, in regular expression format.

pub fn priority(&self) -> Option<&str>

The priority level of this anomaly, as determined by CloudWatch Logs. Priority is computed based on log severity labels such as FATAL and ERROR and the amount of deviation from the baseline. Possible values are HIGH, MEDIUM, and LOW.

pub fn first_seen(&self) -> i64

The date and time when the anomaly detector first saw this anomaly. It is specified as epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.

pub fn last_seen(&self) -> i64

The date and time when the anomaly detector most recently saw this anomaly. It is specified as epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.

pub fn description(&self) -> &str

A human-readable description of the anomaly. This description is generated by CloudWatch Logs.

pub fn active(&self) -> bool

Specifies whether this anomaly is still ongoing.

pub fn state(&self) -> &State

Indicates the current state of this anomaly. If it is still being treated as an anomaly, the value is Active. If you have suppressed this anomaly by using the UpdateAnomaly operation, the value is Suppressed. If this behavior is now considered to be normal, the value is Baseline.

pub fn histogram(&self) -> &HashMap<String, i64>

A map showing times when the anomaly detector ran, and the number of occurrences of this anomaly that were detected at each of those runs. The times are specified in epoch time, which is the number of seconds since January 1, 1970, 00:00:00 UTC.

pub fn log_samples(&self) -> &[LogEvent]

An array of sample log event messages that are considered to be part of this anomaly.

pub fn pattern_tokens(&self) -> &[PatternToken]

An array of structures where each structure contains information about one token that makes up the pattern.

pub fn log_group_arn_list(&self) -> &[String]

An array of ARNS of the log groups that contained log events considered to be part of this anomaly.

pub fn suppressed(&self) -> Option<bool>

Indicates whether this anomaly is currently suppressed. To suppress an anomaly, use UpdateAnomaly.

pub fn suppressed_date(&self) -> i64

If the anomaly is suppressed, this indicates when it was suppressed.

pub fn suppressed_until(&self) -> i64

If the anomaly is suppressed, this indicates when the suppression will end. If this value is 0, the anomaly was suppressed with no expiration, with the INFINITE value.

pub fn is_pattern_level_suppression(&self) -> Option<bool>

If this anomaly is suppressed, this field is true if the suppression is because the pattern is suppressed. If false, then only this particular anomaly is suppressed.

impl Anomaly

pub fn builder() -> AnomalyBuilder

Creates a new builder-style object to manufacture Anomaly.

Trait Implementations

impl Clone for Anomaly

fn clone(&self) -> Anomaly

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Anomaly

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for Anomaly

fn eq(&self, other: &Anomaly) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Anomaly