When you use the AWS API to run a query against Cloudwatch logs, you get back a queryId
.
{
"queryId": "string"
}
You can then call GetQueryResults using that query ID and retrieve results from the query.
{
"results": [
[
{
"field": "string",
"value": "string"
}
]
],
"statistics": {
"bytesScanned": number,
"recordsMatched": number,
"recordsScanned": number
},
"status": "string"
}
My question is how long are these query results retained? Can I run a query, and come back a month later to get the results? A year later?
I can't seem to find any documentation from Amazon that explains the retention policy. In the absence of an official source, I'll accept answers based on anecdotal experience using this API.
From the CloudWatch Logs quotas page:
Results from a query are retrievable for 7 days. This availability time can't be changed.
https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/cloudwatch_limits_cwl.html