sessionize - Amazon CloudWatch Logs
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

sessionize

Use the sessionize command to group events into sessions by identity fields and an inactivity gap. The command emits a session identifier field.

Syntax

| sessionize field[, field ...] [maxspan duration] [AS out]

The command uses the following arguments:

  • field – One or more identity fields to group by.

  • maxspan duration (Optional) – The maximum inactivity gap before starting a new session. Default: 30m.

  • AS out (Optional) – The output field name. Default: session_id.

Example

The following query groups events into sessions by user and device with a 1-hour inactivity gap.

fields @timestamp, userId, deviceId
| sessionize userId, deviceId maxspan 1h as my_session