# AWS::Logs::SubscriptionFilter

Subscription filters allow you to subscribe to a real-time stream of log events and have them delivered to a specific destination.

## Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

### JSON

<pre>
{
    "Type" : "AWS::Logs::SubscriptionFilter",
    "Properties" : {
        "<a href="#filtername" title="FilterName">FilterName</a>" : <i>String</i>,
        "<a href="#destinationarn" title="DestinationArn">DestinationArn</a>" : <i>String</i>,
        "<a href="#filterpattern" title="FilterPattern">FilterPattern</a>" : <i>String</i>,
        "<a href="#loggroupname" title="LogGroupName">LogGroupName</a>" : <i>String</i>,
        "<a href="#rolearn" title="RoleArn">RoleArn</a>" : <i>String</i>,
        "<a href="#distribution" title="Distribution">Distribution</a>" : <i>String</i>
    }
}
</pre>

### YAML

<pre>
Type: AWS::Logs::SubscriptionFilter
Properties:
    <a href="#filtername" title="FilterName">FilterName</a>: <i>String</i>
    <a href="#destinationarn" title="DestinationArn">DestinationArn</a>: <i>String</i>
    <a href="#filterpattern" title="FilterPattern">FilterPattern</a>: <i>String</i>
    <a href="#loggroupname" title="LogGroupName">LogGroupName</a>: <i>String</i>
    <a href="#rolearn" title="RoleArn">RoleArn</a>: <i>String</i>
    <a href="#distribution" title="Distribution">Distribution</a>: <i>String</i>
</pre>

## Properties

#### FilterName

The name of the filter generated by resource.

_Required_: No

_Type_: String

_Update requires_: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

#### DestinationArn

The Amazon Resource Name (ARN) of the destination.

_Required_: Yes

_Type_: String

_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

#### FilterPattern

The filtering expressions that restrict what gets delivered to the destination AWS resource.

_Required_: Yes

_Type_: String

_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

#### LogGroupName

Existing log group that you want to associate with this filter.

_Required_: Yes

_Type_: String

_Update requires_: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

#### RoleArn

The ARN of an IAM role that grants CloudWatch Logs permissions to deliver ingested log events to the destination stream. You don't need to provide the ARN when you are working with a logical destination for cross-account delivery.

_Required_: No

_Type_: String

_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

#### Distribution

The method used to distribute log data to the destination. By default, log data is grouped by log stream, but the grouping can be set to random for a more even distribution. This property is only applicable when the destination is an Amazon Kinesis stream.

_Required_: No

_Type_: String

_Allowed Values_: <code>Random</code> | <code>ByLogStream</code>

_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)