---
title: "POST /list-log-anomalies"
method: POST
path: "/list-log-anomalies"
---

# POST /list-log-anomalies

`POST /list-log-anomalies`

Returns the list of log groups that contain log anomalies.

## Query parameters

- `MaxResults` string
- `NextToken` string

## Request body

- object
  - `InsightId` string, required — The ID of the insight containing the log groups.
  - `MaxResults` integer — The maximum number of results to return with a single call. To retrieve the remaining results, make another call with the returned <code>nextToken</code> value.
  - `NextToken` string — The pagination token to use to retrieve the next page of results for this operation. If this value is null, it retrieves the first page.

## Response `200`

Success

- ListAnomalousLogGroupsResponse
  - `InsightId` string, required — The ID of the insight containing the log groups.
  - `AnomalousLogGroups` AnomalousLogGroup[], required — The list of Amazon CloudWatch log groups that are related to an insight.
    - `LogGroupName` string — The name of the CloudWatch log group.
    - `ImpactStartTime` string, date-time — The time the anomalous log events began. The impact start time indicates the time of the first log anomaly event that occurs.
    - `ImpactEndTime` string, date-time — The time the anomalous log events stopped.
    - `NumberOfLogLinesScanned` integer — The number of log lines that were scanned for anomalous log events.
    - `LogAnomalyShowcases` LogAnomalyShowcase[] — The log anomalies in the log group. Each log anomaly displayed represents a cluster of similar anomalous log events.
      - `LogAnomalyClasses` LogAnomalyClass[] — A list of anomalous log events that may be related.
        - `LogStreamName` string — The name of the Amazon CloudWatch log stream that the anomalous log event belongs to. A log stream is a sequence of log events that share the same source.
        - `LogAnomalyType` 'KEYWORD' | 'KEYWORD_TOKEN' | 'FORMAT' | 'HTTP_CODE' | 'BLOCK_FORMAT' | 'NUMERICAL_POINT' | 'NUMERICAL_NAN' | 'NEW_FIELD_NAME' — The type of log anomaly that has been detected.
        - `LogAnomalyToken` string — The token where the anomaly was detected. This may refer to an exception or another location, or it may be blank for log anomalies such as format anomalies.
        - `LogEventId` string — The ID of the log event.
        - `Explanation` string — The explanation for why the log event is considered an anomaly.
        - `NumberOfLogLinesOccurrences` integer — The number of log lines where this anomalous log event occurs.
        - `LogEventTimestamp` string, date-time — The time of the first occurrence of the anomalous log event.
  - `NextToken` string — The pagination token to use to retrieve the next page of results for this operation. If there are no more pages, this value is null.

## Other responses

- `480` — AccessDeniedException
- `481` — InternalServerException
- `482` — ResourceNotFoundException
- `483` — ThrottlingException
- `484` — ValidationException

---

[API](https://skmtc.net/aws/apis/devops-guru.md) · [All operations](https://skmtc.net/aws/apis/devops-guru/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/devops-guru/versions/0e960c150e92/schema)