1. Add README & Integ tests 2. Address comments

packages/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.log-group.js.snapshot/aws-cdk-log-group-integ.template.json

@@ -112,6 +112,14 @@
       ]
      }
     },
+    "FieldIndexPolicies": [
+     {
+      "Fields": [
+       "Operation",
+       "RequestId"
+      ]
+     }
+    ],
     "RetentionInDays": 731
    },
    "UpdateReplacePolicy": "Retain",

packages/@aws-cdk-testing/framework-integ/test/aws-logs/test/integ.log-group.ts

@@ -1,7 +1,7 @@
 import { Bucket } from 'aws-cdk-lib/aws-s3';
 import { App, Stack, StackProps } from 'aws-cdk-lib';
 import { IntegTest } from '@aws-cdk/integ-tests-alpha';
-import { LogGroup, DataProtectionPolicy, DataIdentifier, CustomDataIdentifier } from 'aws-cdk-lib/aws-logs';
+import { LogGroup, DataProtectionPolicy, DataIdentifier, CustomDataIdentifier, FieldIndexPolicy } from 'aws-cdk-lib/aws-logs';
 
 class LogGroupIntegStack extends Stack {
   constructor(scope: App, id: string, props?: StackProps) {
@@ -19,8 +19,13 @@ class LogGroupIntegStack extends Stack {
       s3BucketAuditDestination: bucket,
     });
 
+    const fieldIndexPolicy = new FieldIndexPolicy({
+      fields: ['Operation', 'RequestId'],
+    });
+
     new LogGroup(this, 'LogGroupLambda', {
       dataProtectionPolicy: dataProtectionPolicy,
+      fieldIndexPolicies: [fieldIndexPolicy],
     });
   }
 }

packages/aws-cdk-lib/aws-logs/README.md

@@ -441,6 +441,43 @@ new logs.LogGroup(this, 'LogGroupLambda', {
 });
 ```
 
+## Field Index Policies
+
+Creates or updates a field index policy for the specified log group. You can use field index policies to create field indexes on fields found in log events in the log group. Creating field indexes lowers the costs for CloudWatch Logs Insights queries that reference those field indexes, because these queries attempt to skip the processing of log events that are known to not match the indexed field. Good fields to index are fields that you often need to query for and fields that have high cardinality of values.
+
+For more information, see [Create field indexes to improve query performance and reduce costs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing.html).
+
+Only log groups in the Standard log class support field index policies.
+Currently, this array supports only one field index policy object.
+
+Example:
+
+```ts
+import { Bucket } from '@aws-cdk/aws-s3';
+import { LogGroup } from '@aws-cdk/logs';
+import * as kinesisfirehose from '@aws-cdk/aws-kinesisfirehose';
+
+
+const logGroupDestination = new LogGroup(this, 'LogGroupLambdaAudit', {
+  logGroupName: 'auditDestinationForCDK',
+});
+
+const s3Destination = new Bucket(this, 'audit-bucket-id');
+
+const deliveryStream = new firehose.DeliveryStream(this, 'Delivery Stream', {
+  destinations: [s3Destination],
+});
+
+const fieldIndexPolicy = new FieldIndexPolicy({
+  fields: ['Operation', 'RequestId'],
+});
+
+new LogGroup(this, 'LogGroupLambda', {
+  logGroupName: 'cdkIntegLogGroup',
+  fieldIndexPolicies: [fieldIndexPolicy],
+});
+```
+
 ## Notes
 
 Be aware that Log Group ARNs will always have the string `:*` appended to

packages/aws-cdk-lib/aws-logs/test/loggroup.test.ts

@@ -950,70 +950,6 @@ test('set field index policy with four fields indexed', () => {
   });
 });
 
-test('set field index policy positive test', () => {
-  // GIVEN
-  const stack = new Stack();
-  const fieldIndexPolicy = new FieldIndexPolicy({
-    fields: ['Operation', 'RequestId', 'timestamp', 'message'],
-  });
-
-  // WHEN
-  const logGroupName = 'test-field-index-policy';
-  new LogGroup(stack, 'LogGroup', {
-    logGroupName: logGroupName,
-    fieldIndexPolicies: [fieldIndexPolicy],
-  });
-
-  // THEN
-  Template.fromStack(stack).hasResourceProperties('AWS::Logs::LogGroup', {
-    LogGroupName: logGroupName,
-    FieldIndexPolicies: [{
-      Fields: [
-        'Operation',
-        'RequestId',
-        'timestamp',
-        'message',
-      ],
-    }],
-  });
-});
-
-test('set multiple field index policies', () => {
-  let message;
-  try {
-    // GIVEN
-    const stack = new Stack();
-    const fieldIndexPolicy = new FieldIndexPolicy({
-      fields: ['Operation', 'RequestId', 'timestamp', 'message'],
-    });
-
-    // WHEN
-    const logGroupName = 'test-field-multiple-field-index-policies';
-    new LogGroup(stack, 'LogGroup', {
-      logGroupName: logGroupName,
-      fieldIndexPolicies: [fieldIndexPolicy, fieldIndexPolicy],
-    });
-
-    // THEN
-    Template.fromStack(stack).hasResourceProperties('AWS::Logs::LogGroup', {
-      LogGroupName: logGroupName,
-      FieldIndexPolicies: [{
-        Fields: [
-          'Operation',
-          'RequestId',
-          'timestamp',
-          'message',
-        ],
-      }],
-    });
-  } catch (e) {
-    message = (e as Error).message;
-  }
-
-  expect(message).toBeDefined();
-  expect(message).toEqual('Only one field index policy is currently supported');
-});
-
 test('set more than 20 field indexes in a field index policy', () => {
   let message;
   try {