CloudWatch

Use AWS CloudWatch to query logs, retrieve log events, inspect log groups and streams, read metrics and alarms, and publish custom metric data. Connect with an AWS access key ID and secret access key.

Choose Query Logs (Insights) for a query across log groups, or Get Log Events for one stream. Metric statistics use a time range and period; alarm actions report the current state. Pass results to later steps for incident investigation or threshold-based notifications.

Use the block

Run Log Insights queries, list log groups, retrieve log events, list and get metrics, and monitor alarms. Requires AWS access key and secret access key.

Actions

CloudWatch Query Logs

Run a CloudWatch Log Insights query against one or more log groups

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`logGroupNames`	array	Yes	Log group names to query
`queryString`	string	Yes	CloudWatch Log Insights query string
`startTime`	number	Yes	Start time as Unix epoch seconds
`endTime`	number	Yes	End time as Unix epoch seconds
`limit`	number	No	Maximum number of results to return

Output

Parameter	Type	Description
`results`	array	Query result rows (each row is a key/value map of field name to value)
`statistics`	object	Query statistics
↳ `bytesScanned`	number	Total bytes of log data scanned
↳ `recordsMatched`	number	Number of log records that matched the query
↳ `recordsScanned`	number	Total log records scanned
`status`	string	Query completion status (Complete, Failed, Cancelled, or Timeout)

CloudWatch Filter Log Events

Search log events across all streams in a log group by filter pattern and time range, without writing a Log Insights query

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`logGroupName`	string	Yes	CloudWatch log group name to search
`filterPattern`	string	No	CloudWatch Logs filter pattern (e.g., "ERROR", "?ERROR ?Exception"). Matches all events if omitted.
`logStreamNamePrefix`	string	No	Only search log streams whose name starts with this prefix
`startTime`	number	No	Start time as Unix epoch seconds
`endTime`	number	No	End time as Unix epoch seconds
`startFromHead`	boolean	No	Return the earliest matching events first instead of the latest
`limit`	number	No	Maximum number of events to return

Output

Parameter	Type	Description
`events`	array	Matching log events across all searched streams, sorted by timestamp
↳ `logStreamName`	string	Log stream the event belongs to
↳ `timestamp`	number	Event timestamp in epoch milliseconds
↳ `message`	string	Log event message
↳ `ingestionTime`	number	Ingestion time in epoch milliseconds

CloudWatch Describe Log Groups

List available CloudWatch log groups

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`prefix`	string	No	Filter log groups by name prefix
`limit`	number	No	Maximum number of log groups to return

Output

Parameter	Type	Description
`logGroups`	array	List of CloudWatch log groups with metadata
↳ `logGroupName`	string	Log group name
↳ `arn`	string	Log group ARN
↳ `storedBytes`	number	Total stored bytes
↳ `retentionInDays`	number	Retention period in days (if set)
↳ `creationTime`	number	Creation time in epoch milliseconds

CloudWatch Get Log Events

Retrieve log events from a specific CloudWatch log stream

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`logGroupName`	string	Yes	CloudWatch log group name
`logStreamName`	string	Yes	CloudWatch log stream name
`startTime`	number	No	Start time as Unix epoch seconds
`endTime`	number	No	End time as Unix epoch seconds
`limit`	number	No	Maximum number of events to return

Output

Parameter	Type	Description
`events`	array	Log events with timestamp, message, and ingestion time
↳ `timestamp`	number	Event timestamp in epoch milliseconds
↳ `message`	string	Log event message
↳ `ingestionTime`	number	Ingestion time in epoch milliseconds

CloudWatch Describe Log Streams

List log streams within a CloudWatch log group

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`logGroupName`	string	Yes	CloudWatch log group name
`prefix`	string	No	Filter log streams by name prefix
`limit`	number	No	Maximum number of log streams to return

Output

Parameter	Type	Description
`logStreams`	array	List of log streams with metadata, sorted by last event time (most recent first) unless a prefix filter is applied
↳ `logStreamName`	string	Log stream name
↳ `lastEventTimestamp`	number	Timestamp of the last log event in epoch milliseconds
↳ `firstEventTimestamp`	number	Timestamp of the first log event in epoch milliseconds
↳ `creationTime`	number	Stream creation time in epoch milliseconds
↳ `storedBytes`	number	Total stored bytes

CloudWatch Set Log Group Retention

Set (or clear, for never-expire) the retention period for a CloudWatch log group

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`logGroupName`	string	Yes	CloudWatch log group name
`retentionInDays`	number	No	Days to retain log events (one of 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653). Omit to make events never expire.

Output

Parameter	Type	Description
`success`	boolean	Whether the retention policy was updated
`logGroupName`	string	Log group the policy applies to
`retentionInDays`	number	Retention period in days, or null if events never expire

CloudWatch List Metrics

List available CloudWatch metrics

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`namespace`	string	No	Filter by namespace (e.g., AWS/EC2, AWS/Lambda)
`metricName`	string	No	Filter by metric name
`recentlyActive`	boolean	No	Only show metrics active in the last 3 hours
`limit`	number	No	Maximum number of metrics to return

Output

Parameter	Type	Description
`metrics`	array	List of metrics with namespace, name, and dimensions
↳ `namespace`	string	Metric namespace (e.g., AWS/EC2)
↳ `metricName`	string	Metric name (e.g., CPUUtilization)
↳ `dimensions`	array	Array of name/value dimension pairs

CloudWatch Get Metric Statistics

Get statistics for a CloudWatch metric over a time range

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`namespace`	string	Yes	Metric namespace (e.g., AWS/EC2, AWS/Lambda)
`metricName`	string	Yes	Metric name (e.g., CPUUtilization, Invocations)
`startTime`	number	Yes	Start time as Unix epoch seconds
`endTime`	number	Yes	End time as Unix epoch seconds
`period`	number	Yes	Granularity in seconds (e.g., 60, 300, 3600)
`statistics`	array	Yes	Statistics to retrieve (Average, Sum, Minimum, Maximum, SampleCount)
`dimensions`	string	No	Dimensions as JSON (e.g., {"InstanceId": "i-1234"})

Output

Parameter	Type	Description
`label`	string	Metric label returned by CloudWatch
`datapoints`	array	Datapoints sorted by timestamp with statistics values
↳ `timestamp`	number	Datapoint timestamp in epoch milliseconds
↳ `average`	number	Average statistic value
↳ `sum`	number	Sum statistic value
↳ `minimum`	number	Minimum statistic value
↳ `maximum`	number	Maximum statistic value
↳ `sampleCount`	number	Sample count statistic value
↳ `unit`	string	Unit of the metric

CloudWatch Publish Metric

Publish a custom metric data point to CloudWatch

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`namespace`	string	Yes	Metric namespace (e.g., Custom/MyApp)
`metricName`	string	Yes	Name of the metric
`value`	number	Yes	Metric value to publish
`unit`	string	No	Unit of the metric (e.g., Count, Seconds, Bytes)
`dimensions`	string	No	JSON string of dimension name/value pairs

Output

Parameter	Type	Description
`success`	boolean	Whether the metric was published successfully
`namespace`	string	Metric namespace
`metricName`	string	Metric name
`value`	number	Published metric value
`unit`	string	Metric unit
`timestamp`	string	Timestamp when the metric was published

CloudWatch Describe Alarms

List and filter CloudWatch alarms

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`alarmNamePrefix`	string	No	Filter alarms by name prefix
`stateValue`	string	No	Filter by alarm state (OK, ALARM, INSUFFICIENT_DATA)
`alarmType`	string	No	Filter by alarm type (MetricAlarm, CompositeAlarm)
`limit`	number	No	Maximum number of alarms to return

Output

Parameter	Type	Description
`alarms`	array	List of CloudWatch alarms with state and configuration
↳ `alarmName`	string	Alarm name
↳ `alarmArn`	string	Alarm ARN
↳ `stateValue`	string	Current state (OK, ALARM, INSUFFICIENT_DATA)
↳ `stateReason`	string	Human-readable reason for the state
↳ `metricName`	string	Metric name (MetricAlarm only)
↳ `namespace`	string	Metric namespace (MetricAlarm only)
↳ `threshold`	number	Threshold value (MetricAlarm only)
↳ `stateUpdatedTimestamp`	number	Epoch ms when state last changed

CloudWatch Describe Alarm History

Retrieve state-change and configuration history for CloudWatch alarms

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`alarmName`	string	No	Name of a specific alarm to retrieve history for. Omit for all alarms.
`historyItemType`	string	No	Filter by history item type (ConfigurationUpdate, StateUpdate, Action, AlarmContributorStateUpdate, AlarmContributorAction)
`startDate`	number	No	Start of the history window as Unix epoch seconds
`endDate`	number	No	End of the history window as Unix epoch seconds
`scanBy`	string	No	Sort order: TimestampDescending (newest first) or TimestampAscending
`limit`	number	No	Maximum number of history records to return

Output

Parameter	Type	Description
`alarmHistoryItems`	array	Alarm history items sorted per scanBy, newest first by default
↳ `alarmName`	string	Name of the alarm this history item belongs to
↳ `alarmType`	string	MetricAlarm or CompositeAlarm
↳ `timestamp`	number	Epoch ms when the history item occurred
↳ `historyItemType`	string	ConfigurationUpdate, StateUpdate, Action, or contributor variants
↳ `historySummary`	string	Human-readable summary of the event

CloudWatch Mute Alarm

Create a CloudWatch alarm mute rule that suppresses alarms for a fixed duration

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`muteRuleName`	string	Yes	Unique name for the mute rule (used later to unmute)
`alarmNames`	array	Yes	Names of the CloudWatch alarms this mute rule targets
`durationValue`	number	Yes	How long the mute lasts (paired with durationUnit)
`durationUnit`	string	Yes	Unit for durationValue: minutes, hours, or days
`description`	string	No	Optional description of why the alarms are being muted
`startDate`	number	No	When the mute window begins as Unix epoch seconds. Defaults to now (mute starts immediately).

Output

Parameter	Type	Description
`success`	boolean	Whether the mute rule was created successfully
`muteRuleName`	string	Name of the mute rule that was created
`alarmNames`	array	Names of the alarms this rule mutes
`expression`	string	Schedule expression used by the mute rule
`duration`	string	ISO 8601 duration of the mute window

CloudWatch Unmute Alarm

Delete a CloudWatch alarm mute rule, restoring alarm notifications

Inputs and outputs

Input

Parameter	Type	Required	Description
`awsRegion`	string	Yes	AWS region (e.g., us-east-1)
`awsAccessKeyId`	string	Yes	AWS access key ID
`awsSecretAccessKey`	string	Yes	AWS secret access key
`muteRuleName`	string	Yes	Name of the mute rule to delete

Output

Parameter	Type	Description
`success`	boolean	Whether the mute rule was deleted successfully
`muteRuleName`	string	Name of the mute rule that was deleted