Awsclaw CloudWatch Logs

Query and manage CloudWatch log groups, streams, events, run Insights queries, and open the interactive log viewer.

When to Use This Skill

Use this skill when the user:

• Asks about CloudWatch logs or log groups
• Wants to search log events or filter by pattern
• Needs to run CloudWatch Insights queries
• Wants to find logs from Lambda, API Gateway, Glue, or other services
• Needs to inspect metric filters, subscriptions, or query definitions
• Wants to open the interactive CloudWatch Log Viewer
• Needs to create, delete, or tag log groups and log streams
• Needs to configure retention policies or resource policies

Tool: CloudWatchLogTool

Execute CloudWatch Logs commands including Insights queries. ALWAYS provide params object.

Commands

DescribeLogGroups

List log groups with optional prefix filter.

{ "command": "DescribeLogGroups", "params": { "logGroupNamePrefix": "/aws/lambda/", "limit": 50 } }

Parameters:

DescribeLogStreams

List log streams in a log group.

{ "command": "DescribeLogStreams", "params": { "logGroupName": "/aws/lambda/my-function", "orderBy": "LastEventTime", "descending": true, "limit": 10 } }

Parameters:

GetLogEvents

Get log events from a specific stream.

{ "command": "GetLogEvents", "params": { "logGroupName": "/aws/lambda/my-function", "logStreamName": "2024/01/01/[$LATEST]abc123", "limit": 100 } }

Parameters:

FilterLogEvents

Search/filter log events across streams in a log group.

{ "command": "FilterLogEvents", "params": { "logGroupName": "/aws/lambda/my-function", "filterPattern": "ERROR" } }

Parameters:

StartQuery

Start a CloudWatch Insights query.

{
  "command": "StartQuery",
  "params": {
    "logGroupName": "/aws/lambda/my-function",
    "queryString": "fields @timestamp, @message | filter @message like /ERROR/ | sort @timestamp desc | limit 20",
    "startTime": 1704067200000,
    "endTime": 1704153600000
  }
}

Parameters:

GetQueryResults

Get results of a CloudWatch Insights query.

{ "command": "GetQueryResults", "params": { "queryId": "12345678-1234-1234-1234-123456789012" } }

Parameters:

GetLogGroupFields

Discover fields in a log group for Insights queries.

{ "command": "GetLogGroupFields", "params": { "logGroupName": "/aws/lambda/my-function" } }

Parameters:

DescribeMetricFilters

List metric filters for a log group.

{ "command": "DescribeMetricFilters", "params": { "logGroupName": "/aws/lambda/my-function" } }

Parameters:

DescribeQueryDefinitions

List saved CloudWatch Insights query definitions.

{ "command": "DescribeQueryDefinitions", "params": {} }

Parameters:

DescribeSubscriptionFilters

List subscription filters for a log group.

{ "command": "DescribeSubscriptionFilters", "params": { "logGroupName": "/aws/lambda/my-function" } }

Parameters:

DescribeDestinations

List log destinations.

{ "command": "DescribeDestinations", "params": {} }

Parameters:

CreateLogGroup

Create a new log group.

{ "command": "CreateLogGroup", "params": { "logGroupName": "/aws/lambda/new-func" } }

CreateLogStream

Create a new log stream in a log group.

{ "command": "CreateLogStream", "params": { "logGroupName": "/aws/lambda/new-func", "logStreamName": "manual" } }

PutLogEvents

Put log events to a log stream.

{ "command": "PutLogEvents", "params": { "logGroupName": "/aws/lambda/new-func", "logStreamName": "manual", "logEvents": [{ "timestamp": 1704067200000, "message": "hello" }] } }

PutRetentionPolicy

Set retention policy for a log group.

{ "command": "PutRetentionPolicy", "params": { "logGroupName": "/aws/lambda/new-func", "retentionInDays": 30 } }

PutMetricFilter

Create or update a metric filter.

{ "command": "PutMetricFilter", "params": { "logGroupName": "/aws/lambda/new-func", "filterName": "ErrorCount", "filterPattern": "ERROR", "metricTransformations": [{ "metricName": "ErrorCount", "metricNamespace": "App", "metricValue": "1" }] } }

PutSubscriptionFilter

Create or update a subscription filter.

{ "command": "PutSubscriptionFilter", "params": { "logGroupName": "/aws/lambda/new-func", "filterName": "to-kinesis", "filterPattern": "", "destinationArn": "arn:aws:kinesis:..." } }

PutResourcePolicy

Create or update a resource policy.

{ "command": "PutResourcePolicy", "params": { "policyName": "cw-policy", "policyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":[\"logs:PutLogEvents\"],\"Resource\":[\"*\"]}]}" } }

DeleteLogGroup

Delete a log group.

{ "command": "DeleteLogGroup", "params": { "logGroupName": "/aws/lambda/old-func" } }

DeleteLogStream

Delete a log stream.

{ "command": "DeleteLogStream", "params": { "logGroupName": "/aws/lambda/new-func", "logStreamName": "manual" } }

DeleteMetricFilter

Delete a metric filter.

{ "command": "DeleteMetricFilter", "params": { "logGroupName": "/aws/lambda/new-func", "filterName": "ErrorCount" } }

DeleteSubscriptionFilter

Delete a subscription filter.

{ "command": "DeleteSubscriptionFilter", "params": { "logGroupName": "/aws/lambda/new-func", "filterName": "to-kinesis" } }

DeleteRetentionPolicy

Remove retention policy (reverts to Never Expire).

{ "command": "DeleteRetentionPolicy", "params": { "logGroupName": "/aws/lambda/new-func" } }

DeleteResourcePolicy

Delete a resource policy.

{ "command": "DeleteResourcePolicy", "params": { "policyName": "cw-policy" } }

TagLogGroup

Tag a log group.

{ "command": "TagLogGroup", "params": { "logGroupName": "/aws/lambda/new-func", "tags": { "env": "prod" } } }

UntagLogGroup

Remove tags from a log group.

{ "command": "UntagLogGroup", "params": { "logGroupName": "/aws/lambda/new-func", "tagKeys": ["env"] } }

OpenCloudWatchLogView

Open the interactive CloudWatch Log Viewer in VS Code.

{ "command": "OpenCloudWatchLogView", "params": { "logGroupName": "/aws/lambda/my-function", "logStreamName": "2024/01/01/[$LATEST]abc123" } }

Parameters:

CloudWatch Log Group Naming Conventions

Use these patterns to find logs from specific AWS services:

Useful Insights Query Examples

Find errors across Lambda functions:

fields @timestamp, @message
| filter @message like /ERROR/
| sort @timestamp desc
| limit 50

Count errors by function:

stats count(*) as errorCount by @logStream
| filter @message like /ERROR/
| sort errorCount desc

Latency analysis:

filter @type = "REPORT"
| stats avg(@duration) as avgDuration, max(@duration) as maxDuration, min(@duration) as minDuration by bin(1h)

Related Services

• CloudWatch → Lambda: Lambda logs at /aws/lambda/{functionName}. Use LambdaTool GetFunctionConfiguration to get function details
• CloudWatch → API Gateway: Execution logs at API-Gateway-Execution-Logs_{id}/{stage}. Use APIGatewayTool GetRestApis to find API IDs
• CloudWatch → Glue: Job logs at /aws-glue/jobs/output. Use GlueTool GetJobRuns to correlate job runs with log timestamps
• CloudWatch → RDS: Database logs at /aws/rds/instance/{id}/{type}. Use RDSTool DescribeDBInstances to find instance IDs
• CloudWatch → EC2: VPC Flow Logs deliver to CloudWatch. Use EC2Tool DescribeFlowLogs to find log group
• CloudWatch → Step Functions: Execution logs at /aws/vendedlogs/states/{name}. Use StepFuncTool to find state machine details