put-anomaly-detector¶

Description¶

Creates an anomaly detection model for a CloudWatch metric. You can use the model to display a band of expected normal values when the metric is graphed.

If you have enabled unified cross-account observability, and this account is a monitoring account, the metric can be in the same account or a source account. You can specify the account ID in the object you specify in the SingleMetricAnomalyDetector parameter.

For more information, see CloudWatch Anomaly Detection .

Synopsis¶

  put-anomaly-detector
[--namespace <value>]
[--metric-name <value>]
[--dimensions <value>]
[--stat <value>]
[--configuration <value>]
[--metric-characteristics <value>]
[--single-metric-anomaly-detector <value>]
[--metric-math-anomaly-detector <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]

Options¶

--namespace (string)

The namespace of the metric to create the anomaly detection model for.

--metric-name (string)

The name of the metric to create the anomaly detection model for.

--dimensions (list)

The metric dimensions to create the anomaly detection model for.

(structure)

A dimension is a name/value pair that is part of the identity of a metric. Because dimensions are part of the unique identifier for a metric, whenever you add a unique name/value pair to one of your metrics, you are creating a new variation of that metric. For example, many Amazon EC2 metrics publish InstanceId as a dimension name, and the actual instance ID as the value for that dimension.

You can assign up to 30 dimensions to a metric.

Name -> (string)

The name of the dimension. Dimension names must contain only ASCII characters, must include at least one non-whitespace character, and cannot start with a colon (: ). ASCII control characters are not supported as part of dimension names.

Value -> (string)

The value of the dimension. Dimension values must contain only ASCII characters and must include at least one non-whitespace character. ASCII control characters are not supported as part of dimension values.

Shorthand Syntax:

Name=string,Value=string ...

JSON Syntax:

[
  {
    "Name": "string",
    "Value": "string"
  }
  ...
]

--stat (string)

The statistic to use for the metric and the anomaly detection model.

--configuration (structure)

The configuration specifies details about how the anomaly detection model is to be trained, including time ranges to exclude when training and updating the model. You can specify as many as 10 time ranges.

The configuration can also include the time zone to use for the metric.

ExcludedTimeRanges -> (list)

An array of time ranges to exclude from use when the anomaly detection model is trained. Use this to make sure that events that could cause unusual values for the metric, such as deployments, aren’t used when CloudWatch creates the model.

(structure)

Specifies one range of days or times to exclude from use for training an anomaly detection model.

StartTime -> (timestamp)

The start time of the range to exclude. The format is yyyy-MM-dd'T'HH:mm:ss . For example, 2019-07-01T23:59:59 .

EndTime -> (timestamp)

The end time of the range to exclude. The format is yyyy-MM-dd'T'HH:mm:ss . For example, 2019-07-01T23:59:59 .

MetricTimezone -> (string)

The time zone to use for the metric. This is useful to enable the model to automatically account for daylight savings time changes if the metric is sensitive to such time changes.

To specify a time zone, use the name of the time zone as specified in the standard tz database. For more information, see tz database .

Shorthand Syntax:

ExcludedTimeRanges=[{StartTime=timestamp,EndTime=timestamp},{StartTime=timestamp,EndTime=timestamp}],MetricTimezone=string

JSON Syntax:

{
  "ExcludedTimeRanges": [
    {
      "StartTime": timestamp,
      "EndTime": timestamp
    }
    ...
  ],
  "MetricTimezone": "string"
}

--metric-characteristics (structure)

Use this object to include parameters to provide information about your metric to CloudWatch to help it build more accurate anomaly detection models. Currently, it includes the PeriodicSpikes parameter.

PeriodicSpikes -> (boolean)

Set this parameter to true if values for this metric consistently include spikes that should not be considered to be anomalies. With this set to true , CloudWatch will expect to see spikes that occurred consistently during the model training period, and won’t flag future similar spikes as anomalies.

Shorthand Syntax:

PeriodicSpikes=boolean

JSON Syntax:

{
  "PeriodicSpikes": true|false
}

--single-metric-anomaly-detector (structure)

A single metric anomaly detector to be created.

When using SingleMetricAnomalyDetector , you cannot include the following parameters in the same operation:

Dimensions

MetricName

Namespace

Stat

the MetricMathAnomalyDetector parameters of PutAnomalyDetectorInput

Instead, specify the single metric anomaly detector attributes as part of the property SingleMetricAnomalyDetector .

AccountId -> (string)

If the CloudWatch metric that provides the time series that the anomaly detector uses as input is in another account, specify that account ID here. If you omit this parameter, the current account is used.

Namespace -> (string)

The namespace of the metric to create the anomaly detection model for.

MetricName -> (string)

The name of the metric to create the anomaly detection model for.

Dimensions -> (list)

The metric dimensions to create the anomaly detection model for.

(structure)

A dimension is a name/value pair that is part of the identity of a metric. Because dimensions are part of the unique identifier for a metric, whenever you add a unique name/value pair to one of your metrics, you are creating a new variation of that metric. For example, many Amazon EC2 metrics publish InstanceId as a dimension name, and the actual instance ID as the value for that dimension.

You can assign up to 30 dimensions to a metric.

Name -> (string)

The name of the dimension. Dimension names must contain only ASCII characters, must include at least one non-whitespace character, and cannot start with a colon (: ). ASCII control characters are not supported as part of dimension names.

Value -> (string)

The value of the dimension. Dimension values must contain only ASCII characters and must include at least one non-whitespace character. ASCII control characters are not supported as part of dimension values.

Stat -> (string)

The statistic to use for the metric and anomaly detection model.

Shorthand Syntax:

AccountId=string,Namespace=string,MetricName=string,Dimensions=[{Name=string,Value=string},{Name=string,Value=string}],Stat=string

JSON Syntax:

{
  "AccountId": "string",
  "Namespace": "string",
  "MetricName": "string",
  "Dimensions": [
    {
      "Name": "string",
      "Value": "string"
    }
    ...
  ],
  "Stat": "string"
}

--metric-math-anomaly-detector (structure)

The metric math anomaly detector to be created.

When using MetricMathAnomalyDetector , you cannot include the following parameters in the same operation:

Dimensions

MetricName

Namespace

Stat

the SingleMetricAnomalyDetector parameters of PutAnomalyDetectorInput

Instead, specify the metric math anomaly detector attributes as part of the property MetricMathAnomalyDetector .

MetricDataQueries -> (list)

An array of metric data query structures that enables you to create an anomaly detector based on the result of a metric math expression. Each item in MetricDataQueries gets a metric or performs a math expression. One item in MetricDataQueries is the expression that provides the time series that the anomaly detector uses as input. Designate the expression by setting ReturnData to true for this object in the array. For all other expressions and metrics, set ReturnData to false . The designated expression must return a single time series.

(structure)

This structure is used in both GetMetricData and PutMetricAlarm . The supported use of this structure is different for those two operations.

When used in GetMetricData , it indicates the metric data to return, and whether this call is just retrieving a batch set of data for one metric, or is performing a Metrics Insights query or a math expression. A single GetMetricData call can include up to 500 MetricDataQuery structures.

When used in PutMetricAlarm , it enables you to create an alarm based on a metric math expression. Each MetricDataQuery in the array specifies either a metric to retrieve, or a math expression to be performed on retrieved metrics. A single PutMetricAlarm call can include up to 20 MetricDataQuery structures in the array. The 20 structures can include as many as 10 structures that contain a MetricStat parameter to retrieve a metric, and as many as 10 structures that contain the Expression parameter to perform a math expression. Of those Expression structures, one must have true as the value for ReturnData . The result of this expression is the value the alarm watches.

Any expression used in a PutMetricAlarm operation must return a single time series. For more information, see Metric Math Syntax and Functions in the Amazon CloudWatch User Guide .

Some of the parameters of this structure also have different uses whether you are using this structure in a GetMetricData operation or a PutMetricAlarm operation. These differences are explained in the following parameter list.

Id -> (string)

A short name used to tie this object to the results in the response. This name must be unique within a single call to GetMetricData . If you are performing math expressions on this set of data, this name represents that data and can serve as a variable in the mathematical expression. The valid characters are letters, numbers, and underscore. The first character must be a lowercase letter.

MetricStat -> (structure)

The metric to be returned, along with statistics, period, and units. Use this parameter only if this object is retrieving a metric and not performing a math expression on returned data.

Within one MetricDataQuery object, you must specify either Expression or MetricStat but not both.

Metric -> (structure)

The metric to return, including the metric name, namespace, and dimensions.

Namespace -> (string)

The namespace of the metric.

MetricName -> (string)

The name of the metric. This is a required field.

Dimensions -> (list)

The dimensions for the metric.

(structure)

A dimension is a name/value pair that is part of the identity of a metric. Because dimensions are part of the unique identifier for a metric, whenever you add a unique name/value pair to one of your metrics, you are creating a new variation of that metric. For example, many Amazon EC2 metrics publish InstanceId as a dimension name, and the actual instance ID as the value for that dimension.

You can assign up to 30 dimensions to a metric.

Name -> (string)

The name of the dimension. Dimension names must contain only ASCII characters, must include at least one non-whitespace character, and cannot start with a colon (: ). ASCII control characters are not supported as part of dimension names.

Value -> (string)

The value of the dimension. Dimension values must contain only ASCII characters and must include at least one non-whitespace character. ASCII control characters are not supported as part of dimension values.

Period -> (integer)

The granularity, in seconds, of the returned data points. For metrics with regular resolution, a period can be as short as one minute (60 seconds) and must be a multiple of 60. For high-resolution metrics that are collected at intervals of less than one minute, the period can be 1, 5, 10, 30, 60, or any multiple of 60. High-resolution metrics are those metrics stored by a PutMetricData call that includes a StorageResolution of 1 second.

If the StartTime parameter specifies a time stamp that is greater than 3 hours ago, you must specify the period as follows or no data points in that time range is returned:

Start time between 3 hours and 15 days ago - Use a multiple of 60 seconds (1 minute).

Start time between 15 and 63 days ago - Use a multiple of 300 seconds (5 minutes).

Start time greater than 63 days ago - Use a multiple of 3600 seconds (1 hour).

Stat -> (string)

The statistic to return. It can include any CloudWatch statistic or extended statistic.

Unit -> (string)

When you are using a Put operation, this defines what unit you want to use when storing the metric.

In a Get operation, if you omit Unit then all data that was collected with any unit is returned, along with the corresponding units that were specified when the data was reported to CloudWatch. If you specify a unit, the operation returns only data that was collected with that unit specified. If you specify a unit that does not match the data collected, the results of the operation are null. CloudWatch does not perform unit conversions.

Expression -> (string)

This field can contain either a Metrics Insights query, or a metric math expression to be performed on the returned data. For more information about Metrics Insights queries, see Metrics Insights query components and syntax in the Amazon CloudWatch User Guide .

A math expression can use the Id of the other metrics or queries to refer to those metrics, and can also use the Id of other expressions to use the result of those expressions. For more information about metric math expressions, see Metric Math Syntax and Functions in the Amazon CloudWatch User Guide .

Within each MetricDataQuery object, you must specify either Expression or MetricStat but not both.

Label -> (string)

A human-readable label for this metric or expression. This is especially useful if this is an expression, so that you know what the value represents. If the metric or expression is shown in a CloudWatch dashboard widget, the label is shown. If Label is omitted, CloudWatch generates a default.

You can put dynamic expressions into a label, so that it is more descriptive. For more information, see Using Dynamic Labels .

ReturnData -> (boolean)

When used in GetMetricData , this option indicates whether to return the timestamps and raw data values of this metric. If you are performing this call just to do math expressions and do not also need the raw data returned, you can specify false . If you omit this, the default of true is used.

When used in PutMetricAlarm , specify true for the one expression result to use as the alarm. For all other metrics and expressions in the same PutMetricAlarm operation, specify ReturnData as False.

Period -> (integer)

The granularity, in seconds, of the returned data points. For metrics with regular resolution, a period can be as short as one minute (60 seconds) and must be a multiple of 60. For high-resolution metrics that are collected at intervals of less than one minute, the period can be 1, 5, 10, 30, 60, or any multiple of 60. High-resolution metrics are those metrics stored by a PutMetricData operation that includes a StorageResolution of 1 second .

AccountId -> (string)

The ID of the account where the metrics are located.

If you are performing a GetMetricData operation in a monitoring account, use this to specify which account to retrieve this metric from.

If you are performing a PutMetricAlarm operation, use this to specify which account contains the metric that the alarm is watching.

JSON Syntax:

{
  "MetricDataQueries": [
    {
      "Id": "string",
      "MetricStat": {
        "Metric": {
          "Namespace": "string",
          "MetricName": "string",
          "Dimensions": [
            {
              "Name": "string",
              "Value": "string"
            }
            ...
          ]
        },
        "Period": integer,
        "Stat": "string",
        "Unit": "Seconds"|"Microseconds"|"Milliseconds"|"Bytes"|"Kilobytes"|"Megabytes"|"Gigabytes"|"Terabytes"|"Bits"|"Kilobits"|"Megabits"|"Gigabits"|"Terabits"|"Percent"|"Count"|"Bytes/Second"|"Kilobytes/Second"|"Megabytes/Second"|"Gigabytes/Second"|"Terabytes/Second"|"Bits/Second"|"Kilobits/Second"|"Megabits/Second"|"Gigabits/Second"|"Terabits/Second"|"Count/Second"|"None"
      },
      "Expression": "string",
      "Label": "string",
      "ReturnData": true|false,
      "Period": integer,
      "AccountId": "string"
    }
    ...
  ]
}

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

Global Options¶

--debug (boolean)

Turn on debug logging.

--endpoint-url (string)

Override command’s default URL with the given URL.

--no-verify-ssl (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

--no-paginate (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

--output (string)

The formatting style for command output.

json
text
table
yaml
yaml-stream

--query (string)

A JMESPath query to use in filtering the response data.

--profile (string)

Use a specific profile from your credential file.

--region (string)

The region to use. Overrides config/env settings.

--version (string)

Display the version of this tool.

--color (string)

Turn on/off color output.

on
off
auto

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

--ca-bundle (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

--cli-read-timeout (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

--cli-connect-timeout (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

--cli-binary-format (string)

The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb:// will always be treated as binary and use the file contents directly regardless of the cli-binary-format setting. When using file:// the file contents will need to properly formatted for the configured cli-binary-format.

base64
raw-in-base64-out

--no-cli-pager (boolean)

Disable cli pager for output.

--cli-auto-prompt (boolean)

Automatically prompt for CLI input parameters.

--no-cli-auto-prompt (boolean)

Disable automatically prompt for CLI input parameters.

Examples¶

Note

To use the following examples, you must have the AWS CLI installed and configured. See the Getting started guide in the AWS CLI User Guide for more information.

Unless otherwise stated, all examples have unix-like quotation rules. These examples will need to be adapted to your terminal’s quoting rules. See Using quotation marks with strings in the AWS CLI User Guide .

To create an anomaly detection model

The following put-anomaly-detector example creates an anomaly detection model for a CloudWatch metric.

aws cloudwatch put-anomaly-detector \
    --namespace AWS/Logs \
    --metric-name IncomingBytes \
    --stat SampleCount

This command produces no output.

For more information, see Using CloudWatch anomaly detection in the Amazon CloudWatch User Guide.

Output¶

None

Table of Contents

Feedback

User Guide

put-anomaly-detector¶

Description¶

Synopsis¶

Options¶

Global Options¶

Examples¶

Note

Output¶