PutLogAlarmInput

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/amazon-cloudwatch/json-schema/amazon-cloudwatch-put-log-alarm-input-schema.json",
  "title": "PutLogAlarmInput",
  "x-generated": "2026-11-11",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/amazon-cloudwatch-amazon-cloudwatch-api-api-openapi.yml#/components/schemas/PutLogAlarmInput",
  "type": "object",
  "properties": {
    "AlarmName": {
      "type": "string",
      "description": "The name for the alarm. This name must be unique within the Amazon Web Services account and Region."
    },
    "AlarmDescription": {
      "type": "string",
      "description": "The description for the alarm."
    },
    "ScheduledQueryConfiguration": {
      "$ref": "#/$defs/ScheduledQueryConfiguration"
    },
    "ActionLogLineCount": {
      "type": "integer",
      "description": "The number of log lines from the most recent scheduled query execution to include in alarm action notifications. Valid range is 0 through 50. The default is 0, which means no log lines are included."
    },
    "ActionLogLineRoleArn": {
      "type": "string",
      "description": "The Amazon Resource Name (ARN) of an IAM role that CloudWatch assumes to retrieve log events for inclusion in alarm action notifications. Required when ActionLogLineCount is greater than 0."
    },
    "ActionsEnabled": {
      "type": "boolean",
      "description": "Indicates whether actions should be executed during any changes to the alarm state. The default is true."
    },
    "OKActions": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The actions to execute when this alarm transitions to the OK state from any other state. Each action is specified as an Amazon Resource Name (ARN). Valid Values: Amazon SNS actions: arn:aws:sns:region:account-id:sns-topic-name Lambda actions: Invoke the latest version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name Invoke a specific version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name:version-number Invoke a function by using an alias Lambda function: arn:aws:lambda:region:account-id:function:function-name:alias-name"
    },
    "AlarmActions": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The actions to execute when this alarm transitions to the ALARM state from any other state. Each action is specified as an Amazon Resource Name (ARN). Valid Values: Amazon SNS actions: arn:aws:sns:region:account-id:sns-topic-name Lambda actions: Invoke the latest version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name Invoke a specific version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name:version-number Invoke a function by using an alias Lambda function: arn:aws:lambda:region:account-id:function:function-name:alias-name Systems Man"
    },
    "InsufficientDataActions": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "The actions to execute when this alarm transitions to the INSUFFICIENT_DATA state from any other state. Each action is specified as an Amazon Resource Name (ARN). Valid Values: Amazon SNS actions: arn:aws:sns:region:account-id:sns-topic-name Lambda actions: Invoke the latest version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name Invoke a specific version of a Lambda function: arn:aws:lambda:region:account-id:function:function-name:version-number Invoke a function by using an alias Lambda function: arn:aws:lambda:region:account-id:function:function-name:alias-name"
    },
    "QueryResultsToEvaluate": {
      "type": "integer",
      "description": "The number of most recent scheduled query results to evaluate against the threshold (the N in M-of-N evaluation). Valid range is 1 through 100."
    },
    "QueryResultsToAlarm": {
      "type": "integer",
      "description": "The number of query results, out of the most recent QueryResultsToEvaluate results, that must breach the threshold to trigger the alarm to transition to ALARM (the M in M-of-N evaluation). Must be less than or equal to QueryResultsToEvaluate."
    },
    "Threshold": {
      "type": "number",
      "description": "The value to compare with the aggregated query result."
    },
    "ComparisonOperator": {
      "type": "string",
      "enum": [
        "GreaterThanOrEqualToThreshold",
        "GreaterThanThreshold",
        "LessThanThreshold",
        "LessThanOrEqualToThreshold",
        "LessThanLowerOrGreaterThanUpperThreshold",
        "LessThanLowerThreshold",
        "GreaterThanUpperThreshold"
      ],
      "description": "The arithmetic operation to use when comparing the aggregated query result and the threshold. The aggregated query result is used as the first operand. Valid values are GreaterThanThreshold, GreaterThanOrEqualToThreshold, LessThanThreshold, and LessThanOrEqualToThreshold."
    },
    "TreatMissingData": {
      "type": "string",
      "description": "Sets how this alarm is to handle missing data points. Valid values are breaching, notBreaching, ignore, and missing. If this parameter is omitted, the default behavior of missing is used."
    },
    "Tags": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/Tag"
      },
      "description": "A list of key-value pairs to associate with the alarm. You can use tags to categorize and manage your alarms."
    },
    "WarmUpConfiguration": {
      "$ref": "#/$defs/WarmUpConfiguration"
    },
    "ActionConfiguration": {
      "$ref": "#/$defs/ActionConfiguration"
    }
  },
  "required": [
    "AlarmName",
    "ScheduledQueryConfiguration",
    "QueryResultsToEvaluate",
    "QueryResultsToAlarm",
    "Threshold",
    "ComparisonOperator"
  ],
  "$defs": {
    "ActionConfiguration": {
      "type": "object",
      "properties": {
        "AlarmTagsPropagation": {
          "$ref": "#/$defs/AlarmTagsPropagation"
        }
      }
    },
    "AlarmTagsPropagation": {
      "type": "object",
      "properties": {
        "Enabled": {
          "type": "boolean",
          "description": "Set to true to include the alarm's tags. Set to false to stop including them. When this is true, you must have the cloudwatch:ListTagsForResource permission on the alarm to create or update it."
        },
        "IncludedTagKeys": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The tag keys to include. Only the alarm's tags with these keys are included. You can specify 1 to 50 tag keys. Each tag key must be 1 to 128 characters long. You can't specify both IncludedTagKeys and ExcludedTagKeys."
        },
        "ExcludedTagKeys": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The tag keys to exclude. All of the alarm's tags except those with these keys are included. You can specify 1 to 50 tag keys. Each tag key must be 1 to 128 characters long. You can't specify both IncludedTagKeys and ExcludedTagKeys."
        }
      },
      "required": [
        "Enabled"
      ]
    },
    "ScheduleConfiguration": {
      "type": "object",
      "properties": {
        "ScheduleExpression": {
          "type": "string",
          "description": "The schedule expression that defines how often the underlying CloudWatch Logs scheduled query runs. Specify a rate() expression, for example rate(5 minutes)."
        },
        "StartTimeOffset": {
          "type": "integer",
          "description": "The offset, in seconds, before the scheduled execution time at which the query time range begins. For example, an offset of 360 (6 minutes) on a query running at 12:05:00 starts the query time range at 11:59:00."
        },
        "EndTimeOffset": {
          "type": "integer",
          "description": "The offset, in seconds, before the scheduled execution time at which the query time range ends. Must be non-negative and less than StartTimeOffset. The default is 0."
        }
      },
      "required": [
        "ScheduleExpression",
        "StartTimeOffset"
      ]
    },
    "ScheduledQueryConfiguration": {
      "type": "object",
      "properties": {
        "QueryString": {
          "type": "string",
          "description": "The CloudWatch Logs query to execute on each scheduled run. Length constraints: maximum of 10,000 characters."
        },
        "LogGroupIdentifiers": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "The log groups to query. Each entry can be a log group name or ARN. Use the ARN form when querying log groups in a different account (for example, when running cross-account queries from a monitoring account). The list must contain between 1 and 50 entries."
        },
        "QueryARN": {
          "type": "string",
          "description": "The Amazon Resource Name (ARN) of the CloudWatch Logs scheduled query that the alarm uses. This field is populated in DescribeAlarms responses."
        },
        "ScheduledQueryRoleARN": {
          "type": "string",
          "description": "The Amazon Resource Name (ARN) of the IAM role that CloudWatch assumes when executing the scheduled query against the configured log groups."
        },
        "ScheduleConfiguration": {
          "$ref": "#/$defs/ScheduleConfiguration"
        },
        "AggregationExpression": {
          "type": "string",
          "description": "The expression that defines how to aggregate query results into one or more scalar values for alarm evaluation. For example, count(*) or avg(latency) by host | sort desc. Length constraints: minimum 1 character, maximum 2048 characters."
        },
        "Tags": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Tag"
          },
          "description": "A list of key-value pairs to associate with the underlying scheduled query resource."
        }
      },
      "required": [
        "QueryString",
        "ScheduledQueryRoleARN",
        "ScheduleConfiguration",
        "AggregationExpression"
      ]
    },
    "Tag": {
      "type": "object",
      "properties": {
        "Key": {
          "type": "string",
          "description": "A string that you can use to assign a value. The combination of tag keys and values can help you organize and categorize your resources."
        },
        "Value": {
          "type": "string",
          "description": "The value for the specified tag key."
        }
      },
      "required": [
        "Key",
        "Value"
      ]
    },
    "WarmUpConfiguration": {
      "type": "object",
      "properties": {
        "WarmUpPeriodDurationInMinutes": {
          "type": "integer",
          "description": "The length of the warm-up period, in minutes. After you create or update the alarm, the alarm stays in INSUFFICIENT_DATA for this duration. During this time, the alarm does not perform alarm actions. You can change this value at any time, including after the warm-up period ends. If you change it after the warm-up period ends, the new value does not restart the warm-up period."
        },
        "OnlyStartEvaluatingAfterWarmUpPeriodEnds": {
          "type": "boolean",
          "description": "Specifies whether the alarm waits for the full warm-up period before it starts to evaluate. The default is false. If true, the alarm waits the entire WarmUpPeriodDurationInMinutes before it starts to evaluate, even if metric data arrives earlier. If false, the alarm ends the warm-up period early. Evaluation begins as soon as the alarm has enough metric data to fill its evaluation window."
        }
      },
      "required": [
        "WarmUpPeriodDurationInMinutes"
      ]
    }
  }
}