Use AWS CloudWatch to query logs, retrieve log events, inspect log groups and streams, read metrics and alarms, and publish custom metric data. Connect with an AWS access key ID and secret access key.

Choose Query Logs (Insights) for a query across log groups, or Get Log Events for one stream. Metric statistics use a time range and period; alarm actions report the current state. Pass results to later steps for incident investigation or threshold-based notifications.

Use the block

Run Log Insights queries, list log groups, retrieve log events, list and get metrics, and monitor alarms. Requires AWS access key and secret access key.

Actions

CloudWatch Query Logs

Run a CloudWatch Log Insights query against one or more log groups

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
logGroupNames	array	Yes	Log group names to query
queryString	string	Yes	CloudWatch Log Insights query string
startTime	number	Yes	Start time as Unix epoch seconds
endTime	number	Yes	End time as Unix epoch seconds
limit	number	No	Maximum number of results to return

Output

Parameter	Type	Description
results	array	Query result rows (each row is a key/value map of field name to value)
statistics	object	Query statistics
↳ bytesScanned	number	Total bytes of log data scanned
↳ recordsMatched	number	Number of log records that matched the query
↳ recordsScanned	number	Total log records scanned
status	string	Query completion status (Complete, Failed, Cancelled, or Timeout)

CloudWatch Filter Log Events

Search log events across all streams in a log group by filter pattern and time range, without writing a Log Insights query

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
logGroupName	string	Yes	CloudWatch log group name to search
filterPattern	string	No	CloudWatch Logs filter pattern (e.g., "ERROR", "?ERROR ?Exception"). Matches all events if omitted.
logStreamNamePrefix	string	No	Only search log streams whose name starts with this prefix
startTime	number	No	Start time as Unix epoch seconds
endTime	number	No	End time as Unix epoch seconds
startFromHead	boolean	No	Return the earliest matching events first instead of the latest
limit	number	No	Maximum number of events to return

Output

Parameter	Type	Description
events	array	Matching log events across all searched streams, sorted by timestamp
↳ logStreamName	string	Log stream the event belongs to
↳ timestamp	number	Event timestamp in epoch milliseconds
↳ message	string	Log event message
↳ ingestionTime	number	Ingestion time in epoch milliseconds

CloudWatch Describe Log Groups

List available CloudWatch log groups

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
prefix	string	No	Filter log groups by name prefix
limit	number	No	Maximum number of log groups to return

Output

Parameter	Type	Description
logGroups	array	List of CloudWatch log groups with metadata
↳ logGroupName	string	Log group name
↳ arn	string	Log group ARN
↳ storedBytes	number	Total stored bytes
↳ retentionInDays	number	Retention period in days (if set)
↳ creationTime	number	Creation time in epoch milliseconds

CloudWatch Get Log Events

Retrieve log events from a specific CloudWatch log stream

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
logGroupName	string	Yes	CloudWatch log group name
logStreamName	string	Yes	CloudWatch log stream name
startTime	number	No	Start time as Unix epoch seconds
endTime	number	No	End time as Unix epoch seconds
limit	number	No	Maximum number of events to return

Output

Parameter	Type	Description
events	array	Log events with timestamp, message, and ingestion time
↳ timestamp	number	Event timestamp in epoch milliseconds
↳ message	string	Log event message
↳ ingestionTime	number	Ingestion time in epoch milliseconds

CloudWatch Describe Log Streams

List log streams within a CloudWatch log group

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
logGroupName	string	Yes	CloudWatch log group name
prefix	string	No	Filter log streams by name prefix
limit	number	No	Maximum number of log streams to return

Output

Parameter	Type	Description
logStreams	array	List of log streams with metadata, sorted by last event time (most recent first) unless a prefix filter is applied
↳ logStreamName	string	Log stream name
↳ lastEventTimestamp	number	Timestamp of the last log event in epoch milliseconds
↳ firstEventTimestamp	number	Timestamp of the first log event in epoch milliseconds
↳ creationTime	number	Stream creation time in epoch milliseconds
↳ storedBytes	number	Total stored bytes

CloudWatch Set Log Group Retention

Set (or clear, for never-expire) the retention period for a CloudWatch log group

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
logGroupName	string	Yes	CloudWatch log group name
retentionInDays	number	No	Days to retain log events (one of 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653). Omit to make events never expire.

Output

Parameter	Type	Description
success	boolean	Whether the retention policy was updated
logGroupName	string	Log group the policy applies to
retentionInDays	number	Retention period in days, or null if events never expire

CloudWatch List Metrics

List available CloudWatch metrics

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
namespace	string	No	Filter by namespace (e.g., AWS/EC2, AWS/Lambda)
metricName	string	No	Filter by metric name
recentlyActive	boolean	No	Only show metrics active in the last 3 hours
limit	number	No	Maximum number of metrics to return

Output

Parameter	Type	Description
metrics	array	List of metrics with namespace, name, and dimensions
↳ namespace	string	Metric namespace (e.g., AWS/EC2)
↳ metricName	string	Metric name (e.g., CPUUtilization)
↳ dimensions	array	Array of name/value dimension pairs

CloudWatch Get Metric Statistics

Get statistics for a CloudWatch metric over a time range

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
namespace	string	Yes	Metric namespace (e.g., AWS/EC2, AWS/Lambda)
metricName	string	Yes	Metric name (e.g., CPUUtilization, Invocations)
startTime	number	Yes	Start time as Unix epoch seconds
endTime	number	Yes	End time as Unix epoch seconds
period	number	Yes	Granularity in seconds (e.g., 60, 300, 3600)
statistics	array	Yes	Statistics to retrieve (Average, Sum, Minimum, Maximum, SampleCount)
dimensions	string	No	Dimensions as JSON (e.g., {"InstanceId": "i-1234"})

Output

Parameter	Type	Description
label	string	Metric label returned by CloudWatch
datapoints	array	Datapoints sorted by timestamp with statistics values
↳ timestamp	number	Datapoint timestamp in epoch milliseconds
↳ average	number	Average statistic value
↳ sum	number	Sum statistic value
↳ minimum	number	Minimum statistic value
↳ maximum	number	Maximum statistic value
↳ sampleCount	number	Sample count statistic value
↳ unit	string	Unit of the metric

CloudWatch Publish Metric

Publish a custom metric data point to CloudWatch

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
namespace	string	Yes	Metric namespace (e.g., Custom/MyApp)
metricName	string	Yes	Name of the metric
value	number	Yes	Metric value to publish
unit	string	No	Unit of the metric (e.g., Count, Seconds, Bytes)
dimensions	string	No	JSON string of dimension name/value pairs

Output

Parameter	Type	Description
success	boolean	Whether the metric was published successfully
namespace	string	Metric namespace
metricName	string	Metric name
value	number	Published metric value
unit	string	Metric unit
timestamp	string	Timestamp when the metric was published

CloudWatch Describe Alarms

List and filter CloudWatch alarms

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
alarmNamePrefix	string	No	Filter alarms by name prefix
stateValue	string	No	Filter by alarm state (OK, ALARM, INSUFFICIENT_DATA)
alarmType	string	No	Filter by alarm type (MetricAlarm, CompositeAlarm)
limit	number	No	Maximum number of alarms to return

Output

Parameter	Type	Description
alarms	array	List of CloudWatch alarms with state and configuration
↳ alarmName	string	Alarm name
↳ alarmArn	string	Alarm ARN
↳ stateValue	string	Current state (OK, ALARM, INSUFFICIENT_DATA)
↳ stateReason	string	Human-readable reason for the state
↳ metricName	string	Metric name (MetricAlarm only)
↳ namespace	string	Metric namespace (MetricAlarm only)
↳ threshold	number	Threshold value (MetricAlarm only)
↳ stateUpdatedTimestamp	number	Epoch ms when state last changed

CloudWatch Describe Alarm History

Retrieve state-change and configuration history for CloudWatch alarms

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
alarmName	string	No	Name of a specific alarm to retrieve history for. Omit for all alarms.
historyItemType	string	No	Filter by history item type (ConfigurationUpdate, StateUpdate, Action, AlarmContributorStateUpdate, AlarmContributorAction)
startDate	number	No	Start of the history window as Unix epoch seconds
endDate	number	No	End of the history window as Unix epoch seconds
scanBy	string	No	Sort order: TimestampDescending (newest first) or TimestampAscending
limit	number	No	Maximum number of history records to return

Output

Parameter	Type	Description
alarmHistoryItems	array	Alarm history items sorted per scanBy, newest first by default
↳ alarmName	string	Name of the alarm this history item belongs to
↳ alarmType	string	MetricAlarm or CompositeAlarm
↳ timestamp	number	Epoch ms when the history item occurred
↳ historyItemType	string	ConfigurationUpdate, StateUpdate, Action, or contributor variants
↳ historySummary	string	Human-readable summary of the event

CloudWatch Mute Alarm

Create a CloudWatch alarm mute rule that suppresses alarms for a fixed duration

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
muteRuleName	string	Yes	Unique name for the mute rule (used later to unmute)
alarmNames	array	Yes	Names of the CloudWatch alarms this mute rule targets
durationValue	number	Yes	How long the mute lasts (paired with durationUnit)
durationUnit	string	Yes	Unit for durationValue: minutes, hours, or days
description	string	No	Optional description of why the alarms are being muted
startDate	number	No	When the mute window begins as Unix epoch seconds. Defaults to now (mute starts immediately).

Output

Parameter	Type	Description
success	boolean	Whether the mute rule was created successfully
muteRuleName	string	Name of the mute rule that was created
alarmNames	array	Names of the alarms this rule mutes
expression	string	Schedule expression used by the mute rule
duration	string	ISO 8601 duration of the mute window

CloudWatch Unmute Alarm

Delete a CloudWatch alarm mute rule, restoring alarm notifications

Inputs and outputs

Input

Parameter	Type	Required	Description
awsRegion	string	Yes	AWS region (e.g., us-east-1)
awsAccessKeyId	string	Yes	AWS access key ID
awsSecretAccessKey	string	Yes	AWS secret access key
muteRuleName	string	Yes	Name of the mute rule to delete

Output

Parameter	Type	Description
success	boolean	Whether the mute rule was deleted successfully
muteRuleName	string	Name of the mute rule that was deleted