aws logs
You can use Amazon CloudWatch Logs to monitor, store, and access your log files from EC2 instances, CloudTrail, and other sources. AWS CLI reference
119 commands Its page in the AWS CLI reference
Commands
associate-kms-keyAssociates the specified KMS key with either one log group in the account, or with all stored CloudWatch Logs query insights results in the account.associate-source-to-s3-table-integrationAssociates a data source with an S3 Table Integration for query access in the 'logs' namespace.cancel-export-taskCancels the specified export task.cancel-import-taskCancels an active import task and stops importing data from the CloudTrail Lake Event Data Store.create-deliveryCreates a delivery.create-export-taskCreates an export task so that you can efficiently export data from a log group to an Amazon S3 bucket.create-import-taskStarts an import from a data source to CloudWatch Log and creates a managed log group as the destination for the imported data.create-log-anomaly-detectorCreates an anomaly detector that regularly scans one or more log groups and look for patterns and anomalies in the logs.create-log-groupCreates a log group with the specified name.create-log-streamCreates a log stream for the specified log group.create-lookup-tableCreates a lookup table by uploading CSV data or from CloudWatch Logs query results.create-scheduled-queryCreates a scheduled query that runs CloudWatch Logs Insights queries at regular intervals.delete-account-policyDeletes a CloudWatch Logs account policy.delete-data-protection-policyDeletes the data protection policy from the specified log group.delete-deliveryDeletes a delivery.delete-delivery-destinationDeletes a delivery destination.delete-delivery-destination-policyDeletes a delivery destination policy.delete-delivery-sourceDeletes a delivery source.delete-destinationDeletes the specified destination, and eventually disables all the subscription filters that publish to it.delete-index-policyDeletes a log-group level field index policy that was applied to a single log group.delete-integrationDeletes the integration between CloudWatch Logs and OpenSearch Service.delete-log-anomaly-detectorDeletes the specified CloudWatch Logs anomaly detector.delete-log-groupDeletes the specified log group and permanently deletes all the archived log events associated with the log group.delete-log-streamDeletes the specified log stream and permanently deletes all the archived log events associated with the log stream.delete-lookup-tableDeletes a lookup table permanently.delete-metric-filterDeletes the specified metric filter.delete-query-definitionDeletes a saved CloudWatch Logs Insights query definition.delete-resource-policyDeletes a resource policy from this account.delete-retention-policyDeletes the specified retention policy.delete-scheduled-queryDeletes a scheduled query and stops all future executions.delete-subscription-filterDeletes the specified subscription filter.delete-syslog-configurationDeletes a syslog configuration for a log group.delete-transformerDeletes the log transformer for the specified log group.describe-account-policiesReturns a list of all CloudWatch Logs account policies in the account.describe-configuration-templatesUse this operation to return the valid and default values that are used when creating delivery sources, delivery destinations, and deliveries.describe-deliveriesRetrieves a list of the deliveries that have been created in the account.describe-delivery-destinationsRetrieves a list of the delivery destinations that have been created in the account.describe-delivery-sourcesRetrieves a list of the delivery sources that have been created in the account.describe-destinationsLists all your destinations.describe-export-tasksLists the specified export tasks.describe-field-indexesReturns a list of field indexes discovered in log data.describe-import-task-batchesGets detailed information about the individual batches within an import task, including their status and any error messages.describe-import-tasksLists and describes import tasks, with optional filtering by import status and source ARN.describe-index-policiesReturns the field index policies of the specified log group.describe-log-groupsReturns information about log groups, including data sources that ingest into each log group.describe-log-streamsLists the log streams for the specified log group.describe-lookup-tablesRetrieves metadata about lookup tables in your account.describe-metric-filtersLists the specified metric filters.describe-queriesReturns a list of CloudWatch Logs Insights queries that are scheduled, running, or have been run recently in this account.describe-query-definitionsThis operation returns a paginated list of your saved CloudWatch Logs Insights query definitions.describe-resource-policiesLists the resource policies in this account.describe-subscription-filtersLists the subscription filters for the specified log group.disassociate-kms-keyDisassociates the specified KMS key from the specified log group or from all CloudWatch Logs Insights query results in the account.disassociate-source-from-s3-table-integrationDisassociates a data source from an S3 Table Integration, removing query access and deleting all associated data from the integration.filter-log-eventsLists log events from the specified log group.get-data-protection-policyReturns information about a log group data protection policy.get-deliveryReturns complete information about one logical delivery.get-delivery-destinationRetrieves complete information about one delivery destination.get-delivery-destination-policyRetrieves the delivery destination policy assigned to the delivery destination that you specify.get-delivery-sourceRetrieves complete information about one delivery source.get-integrationReturns information about one integration between CloudWatch Logs and OpenSearch Service.get-log-anomaly-detectorRetrieves information about the log anomaly detector that you specify.get-log-eventsLists log events from the specified log stream.get-log-fieldsDiscovers available fields for a specific data source and type.get-log-group-fieldsReturns a list of the fields that are included in log events in the specified log group.get-log-objectRetrieves a large logging object (LLO) and streams it back.get-log-recordRetrieves all of the fields and values of a single log event.get-lookup-tableRetrieves the full content of a lookup table, including the CSV data.get-query-resultsReturns the results from the specified query.get-scheduled-queryRetrieves details about a specific scheduled query, including its configuration, execution status, and metadata.get-scheduled-query-historyRetrieves the execution history of a scheduled query within a specified time range, including query results and destination processing status.get-storage-tier-policyReturns the storage tier policy for the account.get-transformerReturns the information about the log transformer associated with this log group.list-aggregate-log-group-summariesReturns an aggregate summary of all log groups in the Region grouped by specified data source characteristics.list-anomaliesReturns a list of anomalies that log anomaly detectors have found.list-integrationsReturns a list of integrations between CloudWatch Logs and other services in this account.list-log-anomaly-detectorsRetrieves a list of the log anomaly detectors in the account.list-log-groupsReturns a list of log groups in the Region in your account.list-log-groups-for-queryReturns a list of the log groups that were analyzed during a single CloudWatch Logs Insights query.list-scheduled-queriesLists all scheduled queries in your account and region.list-sources-for-s3-table-integrationReturns a list of data source associations for a specified S3 Table Integration, showing which data sources are currently associated for query access.list-syslog-configurationsReturns a list of syslog configurations.list-tags-for-resourceDisplays the tags associated with a CloudWatch Logs resource.list-tags-log-groupThe ListTagsLogGroup operation is on the path to deprecation.put-account-policyCreates an account-level data protection policy, subscription filter policy, field index policy, transformer policy, metric extraction policy, or retention policy that applies to all log groups, a subset of log groups, or a data source name and type combination in the account.put-bearer-token-authenticationEnables or disables bearer token authentication for the specified log group.put-data-protection-policyCreates a data protection policy for the specified log group.put-delivery-destinationCreates or updates a logical delivery destination.put-delivery-destination-policyCreates and assigns an IAM policy that grants permissions to CloudWatch Logs to deliver logs cross-account to a specified destination in this account.put-delivery-sourceCreates or updates a logical delivery source.put-destinationCreates or updates a destination.put-destination-policyCreates or updates an access policy associated with an existing destination.put-index-policyCreates or updates a field index policy for the specified log group.put-integrationCreates an integration between CloudWatch Logs and another service in this account.put-log-eventsUploads a batch of log events to the specified log stream.put-log-group-deletion-protectionEnables or disables deletion protection for the specified log group.put-metric-filterCreates or updates a metric filter and associates it with the specified log group.put-query-definitionCreates or updates a query definition for CloudWatch Logs Insights.put-resource-policyCreates or updates a resource policy allowing other Amazon Web Services services to put log events to this account, such as Amazon Route 53.put-retention-policySets the retention of the specified log group.put-storage-tier-policySets the storage tier policy for the account.put-subscription-filterCreates or updates a subscription filter and associates it with the specified log group.put-syslog-configurationCreates or updates a syslog configuration for a log group.put-transformerCreates or updates a log transformer for a single log group.start-live-tailStarts a Live Tail streaming session for one or more log groups.start-queryStarts a query of one or more log groups or data sources using CloudWatch Logs Insights.stop-queryStops a CloudWatch Logs Insights query that is in progress.tag-log-groupThe TagLogGroup operation is on the path to deprecation.tag-resourceAssigns one or more tags (key-value pairs) to the specified CloudWatch Logs resource.tailTails the logs for a CloudWatch Logs group.test-metric-filterTests the filter pattern of a metric filter against a sample of log event messages.test-transformerUse this operation to test a log transformer.untag-log-groupThe UntagLogGroup operation is on the path to deprecation.untag-resourceRemoves one or more tags from the specified resource.update-anomalyUse this operation to suppress anomaly detection for a specified anomaly or pattern.update-delivery-configurationUse this operation to update the configuration of a delivery to change either the S3 path pattern or the format of the delivered logs.update-log-anomaly-detectorUpdates an existing log anomaly detector.update-lookup-tableUpdates an existing lookup table by replacing all of its content with new CSV data or CloudWatch Logs query results.update-scheduled-queryUpdates an existing scheduled query with new configuration.