You can use Amazon CloudWatch Logs to monitor, store, and access your log files from EC2 instances, CloudTrail, and other sources. You can then retrieve the associated log data from CloudWatch Logs using the CloudWatch console. Alternatively, you can use CloudWatch Logs commands in the Amazon Web Services CLI, CloudWatch Logs API, or CloudWatch Logs SDK.
You can use CloudWatch Logs to:
Monitor logs from EC2 instances in real time: You can use CloudWatch Logs to monitor applications and systems using log data. For example, CloudWatch Logs can track the number of errors that occur in your application logs. Then, it can send you a notification whenever the rate of errors exceeds a threshold that you specify. CloudWatch Logs uses your log data for monitoring so no code changes are required. For example, you can monitor application logs for specific literal terms (such as "NullReferenceException"). You can also count the number of occurrences of a literal term at a particular position in log data (such as "404" status codes in an Apache access log). When the term you are searching for is found, CloudWatch Logs reports the data to a CloudWatch metric that you specify.
Monitor CloudTrail logged events: You can create alarms in CloudWatch and receive notifications of particular API activity as captured by CloudTrail. You can use the notification to perform troubleshooting.
Archive log data: You can use CloudWatch Logs to store your log data in highly durable storage. You can change the log retention setting so that any log events earlier than this setting are automatically deleted. The CloudWatch Logs agent helps to quickly send both rotated and non-rotated log data off of a host and into the log service. You can then access the raw log data when you need it.
Arguments
- config
Optional configuration of credentials, endpoint, and/or region.
credentials:
creds:
access_key_id: AWS access key ID
secret_access_key: AWS secret access key
session_token: AWS temporary session token
profile: The name of a profile to use. If not given, then the default profile is used.
anonymous: Set anonymous credentials.
endpoint: The complete URL to use for the constructed client.
region: The AWS Region used in instantiating the client.
close_connection: Immediately close all HTTP connections.
timeout: The time in seconds till a timeout exception is thrown when attempting to make a connection. The default is 60 seconds.
s3_force_path_style: Set this to
trueto force the request to use path-style addressing, i.e.http://s3.amazonaws.com/BUCKET/KEY.sts_regional_endpoint: Set sts regional endpoint resolver to regional or legacy https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html
- credentials
Optional credentials shorthand for the config parameter
creds:
access_key_id: AWS access key ID
secret_access_key: AWS secret access key
session_token: AWS temporary session token
profile: The name of a profile to use. If not given, then the default profile is used.
anonymous: Set anonymous credentials.
- endpoint
Optional shorthand for complete URL to use for the constructed client.
- region
Optional shorthand for AWS Region used in instantiating the client.
Value
A client for the service. You can call the service's operations using
syntax like svc$operation(...), where svc is the name you've assigned
to the client. The available operations are listed in the
Operations section.
Service syntax
svc <- cloudwatchlogs(
config = list(
credentials = list(
creds = list(
access_key_id = "string",
secret_access_key = "string",
session_token = "string"
),
profile = "string",
anonymous = "logical"
),
endpoint = "string",
region = "string",
close_connection = "logical",
timeout = "numeric",
s3_force_path_style = "logical",
sts_regional_endpoint = "string"
),
credentials = list(
creds = list(
access_key_id = "string",
secret_access_key = "string",
session_token = "string"
),
profile = "string",
anonymous = "logical"
),
endpoint = "string",
region = "string"
)Operations
| associate_kms_key | Associates the specified KMS key with either one log group in the account, or with all stored CloudWatch Logs query insights results in the account |
| associate_source_to_s3_table_integration | Associates a data source with an S3 Table Integration for query access in the 'logs' namespace |
| cancel_export_task | Cancels the specified export task |
| cancel_import_task | Cancels an active import task and stops importing data from the CloudTrail Lake Event Data Store |
| create_delivery | Creates a delivery |
| create_export_task | Creates an export task so that you can efficiently export data from a log group to an Amazon S3 bucket |
| create_import_task | Starts an import from a data source to CloudWatch Log and creates a managed log group as the destination for the imported data |
| create_log_anomaly_detector | Creates an anomaly detector that regularly scans one or more log groups and look for patterns and anomalies in the logs |
| create_log_group | Creates a log group with the specified name |
| create_log_stream | Creates a log stream for the specified log group |
| create_lookup_table | Creates a lookup table by uploading CSV data |
| create_scheduled_query | Creates a scheduled query that runs CloudWatch Logs Insights queries at regular intervals |
| delete_account_policy | Deletes a CloudWatch Logs account policy |
| delete_data_protection_policy | Deletes the data protection policy from the specified log group |
| delete_delivery | Deletes a delivery |
| delete_delivery_destination | Deletes a delivery destination |
| delete_delivery_destination_policy | Deletes a delivery destination policy |
| delete_delivery_source | Deletes a delivery source |
| delete_destination | Deletes the specified destination, and eventually disables all the subscription filters that publish to it |
| delete_index_policy | Deletes a log-group level field index policy that was applied to a single log group |
| delete_integration | Deletes the integration between CloudWatch Logs and OpenSearch Service |
| delete_log_anomaly_detector | Deletes the specified CloudWatch Logs anomaly detector |
| delete_log_group | Deletes the specified log group and permanently deletes all the archived log events associated with the log group |
| delete_log_stream | Deletes the specified log stream and permanently deletes all the archived log events associated with the log stream |
| delete_lookup_table | Deletes a lookup table permanently |
| delete_metric_filter | Deletes the specified metric filter |
| delete_query_definition | Deletes a saved CloudWatch Logs Insights query definition |
| delete_resource_policy | Deletes a resource policy from this account |
| delete_retention_policy | Deletes the specified retention policy |
| delete_scheduled_query | Deletes a scheduled query and stops all future executions |
| delete_subscription_filter | Deletes the specified subscription filter |
| delete_transformer | Deletes the log transformer for the specified log group |
| describe_account_policies | Returns a list of all CloudWatch Logs account policies in the account |
| describe_configuration_templates | Use this operation to return the valid and default values that are used when creating delivery sources, delivery destinations, and deliveries |
| describe_deliveries | Retrieves a list of the deliveries that have been created in the account |
| describe_delivery_destinations | Retrieves a list of the delivery destinations that have been created in the account |
| describe_delivery_sources | Retrieves a list of the delivery sources that have been created in the account |
| describe_destinations | Lists all your destinations |
| describe_export_tasks | Lists the specified export tasks |
| describe_field_indexes | Returns a list of custom and default field indexes which are discovered in log data |
| describe_import_task_batches | Gets detailed information about the individual batches within an import task, including their status and any error messages |
| describe_import_tasks | Lists and describes import tasks, with optional filtering by import status and source ARN |
| describe_index_policies | Returns the field index policies of the specified log group |
| describe_log_groups | Returns information about log groups, including data sources that ingest into each log group |
| describe_log_streams | Lists the log streams for the specified log group |
| describe_lookup_tables | Retrieves metadata about lookup tables in your account |
| describe_metric_filters | Lists the specified metric filters |
| describe_queries | Returns a list of CloudWatch Logs Insights queries that are scheduled, running, or have been run recently in this account |
| describe_query_definitions | This operation returns a paginated list of your saved CloudWatch Logs Insights query definitions |
| describe_resource_policies | Lists the resource policies in this account |
| describe_subscription_filters | Lists the subscription filters for the specified log group |
| disassociate_kms_key | Disassociates the specified KMS key from the specified log group or from all CloudWatch Logs Insights query results in the account |
| disassociate_source_from_s3_table_integration | Disassociates a data source from an S3 Table Integration, removing query access and deleting all associated data from the integration |
| filter_log_events | Lists log events from the specified log group |
| get_data_protection_policy | Returns information about a log group data protection policy |
| get_delivery | Returns complete information about one logical delivery |
| get_delivery_destination | Retrieves complete information about one delivery destination |
| get_delivery_destination_policy | Retrieves the delivery destination policy assigned to the delivery destination that you specify |
| get_delivery_source | Retrieves complete information about one delivery source |
| get_integration | Returns information about one integration between CloudWatch Logs and OpenSearch Service |
| get_log_anomaly_detector | Retrieves information about the log anomaly detector that you specify |
| get_log_events | Lists log events from the specified log stream |
| get_log_fields | Discovers available fields for a specific data source and type |
| get_log_group_fields | Returns a list of the fields that are included in log events in the specified log group |
| get_log_object | Retrieves a large logging object (LLO) and streams it back |
| get_log_record | Retrieves all of the fields and values of a single log event |
| get_lookup_table | Retrieves the full content of a lookup table, including the CSV data |
| get_query_results | Returns the results from the specified query |
| get_scheduled_query | Retrieves details about a specific scheduled query, including its configuration, execution status, and metadata |
| get_scheduled_query_history | Retrieves the execution history of a scheduled query within a specified time range, including query results and destination processing status |
| get_transformer | Returns the information about the log transformer associated with this log group |
| list_aggregate_log_group_summaries | Returns an aggregate summary of all log groups in the Region grouped by specified data source characteristics |
| list_anomalies | Returns a list of anomalies that log anomaly detectors have found |
| list_integrations | Returns a list of integrations between CloudWatch Logs and other services in this account |
| list_log_anomaly_detectors | Retrieves a list of the log anomaly detectors in the account |
| list_log_groups | Returns a list of log groups in the Region in your account |
| list_log_groups_for_query | Returns a list of the log groups that were analyzed during a single CloudWatch Logs Insights query |
| list_scheduled_queries | Lists all scheduled queries in your account and region |
| list_sources_for_s3_table_integration | Returns a list of data source associations for a specified S3 Table Integration, showing which data sources are currently associated for query access |
| list_tags_for_resource | Displays the tags associated with a CloudWatch Logs resource |
| list_tags_log_group | The ListTagsLogGroup operation is on the path to deprecation |
| put_account_policy | Creates an account-level data protection policy, subscription filter policy, field index policy, transformer policy, or metric extraction policy that applies to all log groups, a subset of log groups, or a data source name and type combination in the account |
| put_bearer_token_authentication | Enables or disables bearer token authentication for the specified log group |
| put_data_protection_policy | Creates a data protection policy for the specified log group |
| put_delivery_destination | Creates or updates a logical delivery destination |
| put_delivery_destination_policy | Creates and assigns an IAM policy that grants permissions to CloudWatch Logs to deliver logs cross-account to a specified destination in this account |
| put_delivery_source | Creates or updates a logical delivery source |
| put_destination | Creates or updates a destination |
| put_destination_policy | Creates or updates an access policy associated with an existing destination |
| put_index_policy | Creates or updates a field index policy for the specified log group |
| put_integration | Creates an integration between CloudWatch Logs and another service in this account |
| put_log_events | Uploads a batch of log events to the specified log stream |
| put_log_group_deletion_protection | Enables or disables deletion protection for the specified log group |
| put_metric_filter | Creates or updates a metric filter and associates it with the specified log group |
| put_query_definition | Creates or updates a query definition for CloudWatch Logs Insights |
| put_resource_policy | Creates or updates a resource policy allowing other Amazon Web Services services to put log events to this account, such as Amazon Route 53 |
| put_retention_policy | Sets the retention of the specified log group |
| put_subscription_filter | Creates or updates a subscription filter and associates it with the specified log group |
| put_transformer | Creates or updates a log transformer for a single log group |
| start_live_tail | Starts a Live Tail streaming session for one or more log groups |
| start_query | Starts a query of one or more log groups or data sources using CloudWatch Logs Insights |
| stop_query | Stops a CloudWatch Logs Insights query that is in progress |
| tag_log_group | The TagLogGroup operation is on the path to deprecation |
| tag_resource | Assigns one or more tags (key-value pairs) to the specified CloudWatch Logs resource |
| test_metric_filter | Tests the filter pattern of a metric filter against a sample of log event messages |
| test_transformer | Use this operation to test a log transformer |
| untag_log_group | The UntagLogGroup operation is on the path to deprecation |
| untag_resource | Removes one or more tags from the specified resource |
| update_anomaly | Use this operation to suppress anomaly detection for a specified anomaly or pattern |
| update_delivery_configuration | Use this operation to update the configuration of a delivery to change either the S3 path pattern or the format of the delivered logs |
| update_log_anomaly_detector | Updates an existing log anomaly detector |
| update_lookup_table | Updates an existing lookup table by replacing all of its CSV content |
| update_scheduled_query | Updates an existing scheduled query with new configuration |