Querying log group retention

[fauxbytes]

Hi.
Is there a cli command to query the current retention setting for a log group?
Thanks

[RyanFitzSimmonsAK]

Hi @fauxbytes, thanks for reaching out. You should be able to do this with aws logs describe-log groups (https://awscli.amazonaws.com/v2/documentation/api/latest/reference/logs/describe-log-groups.html) and specifying the log group you want to query. Let me know if you have any follow-up questions.

@github-actions proposed answer

[fauxbytes]

Thanks @RyanFitzSimmonsAK .
Could it be that retentionInDays is not listed:

1. when using --log-group-name-pattern?
2. when retention is set to 'never expire'?

[RyanFitzSimmonsAK]

Is retentionInDays not appearing in the response? Could you provide debug logs? You can get debug logs by adding --debug to your command and redacting any sensitive information.

[jd-ucpa]

I confirm the retentionInDays is still not available 2 years later in aws-cli/2.23.14 Python/3.12.9 Darwin/22.6.0 source/arm64
Only visible when --debug flag is here

[jd-ucpa]

It's a "hole" in the API, because the help show the retentionInDays property
https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html#examples

{
    "logGroups": [
        {
            "storedBytes": 0,
            "metricFilterCount": 0,
            "creationTime": 1433189500783,
            "logGroupName": "my-logs",
            "retentionInDays": 5,   <--- here
            "arn": "arn:aws:logs:us-west-2:0123456789012:log-group:my-logs:*"
        }
    ]
}

But if you create an StateMachine with the same describeLogGroups API call :

{
  "QueryLanguage": "JSONata",
  "Comment": "A description of my state machine",
  "StartAt": "DescribeLogGroups",
  "States": {
    "DescribeLogGroups": {
      "Type": "Task",
      "Arguments": {},
      "Resource": "arn:aws:states:::aws-sdk:cloudwatchlogs:describeLogGroups",  <--- here
      "End": true
    }
  }
}

The result is still without the retentionInDays property !

[uldyssian-sh]

Hi!

Yes — you can query the retention setting via describe-log-groups.

1) Get retention for a specific log group

Use --log-group-name-prefix (not --log-group-name-pattern) and then filter to the exact name:

LOG_GROUP="YourLogGroupName"

aws logs describe-log-groups \
  --log-group-name-prefix "$LOG_GROUP" \
  --query "logGroups[?logGroupName=='$LOG_GROUP'].retentionInDays | [0]" \
  --output text

[uldyssian-sh]

(a) If you use --log-group-name-pattern:
This is expected. Per the CLI docs, when logGroupNamePattern is used, the response includes only arn, creationTime, and logGroupName — so fields like retentionInDays are not returned.
(So: use --log-group-name-prefix if you need retention.)
https://docs.aws.amazon.com/cli/latest/reference/logs/describe-log-groups.html

(b) If retention is “Never expire”:
Also expected: if there is no retention policy set, retentionInDays is not present (or effectively null) and logs are kept indefinitely.
To explicitly make a log group “never expire”, AWS uses DeleteRetentionPolicy (as noted in the API docs for retention policy behavior).
https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutRetentionPolicy.html

[uldyssian-sh]

Thanks! If this helps, please consider marking it as “Helpful” or “Accepted” 😊