# CloudWatch (/integrations/cloudwatch)





{/* MANUAL-CONTENT-START:intro */}

Use [AWS CloudWatch](https://aws.amazon.com/cloudwatch/) to query logs, retrieve log events, inspect log groups and streams, read metrics and alarms, and publish custom metric data. Connect with an AWS access key ID and secret access key.

Choose **Query Logs (Insights)** for a query across log groups, or **Get Log Events** for one stream. Metric statistics use a time range and period; alarm actions report the current state. Pass results to later steps for incident investigation or threshold-based notifications.

{/* MANUAL-CONTENT-END */}

## Use the block [#usage-instructions]

Run Log Insights queries, list log groups, retrieve log events, list and get metrics, and monitor alarms. Requires AWS access key and secret access key.

## Actions [#actions]

### CloudWatch Query Logs [#cloudwatch-query-logs]

Run a CloudWatch Log Insights query against one or more log groups

<ReferenceDetails>
  #### Input [#input]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `logGroupNames` | array | Yes | Log group names to query |
  | `queryString` | string | Yes | CloudWatch Log Insights query string |
  | `startTime` | number | Yes | Start time as Unix epoch seconds |
  | `endTime` | number | Yes | End time as Unix epoch seconds |
  | `limit` | number | No | Maximum number of results to return |

  #### Output [#output]

  | Parameter | Type | Description |
  | - | - | - |
  | `results` | array | Query result rows (each row is a key/value map of field name to value) |
  | `statistics` | object | Query statistics |
  | ↳ `bytesScanned` | number | Total bytes of log data scanned |
  | ↳ `recordsMatched` | number | Number of log records that matched the query |
  | ↳ `recordsScanned` | number | Total log records scanned |
  | `status` | string | Query completion status (Complete, Failed, Cancelled, or Timeout) |
</ReferenceDetails>

### CloudWatch Filter Log Events [#cloudwatch-filter-log-events]

Search log events across all streams in a log group by filter pattern and time range, without writing a Log Insights query

<ReferenceDetails>
  #### Input [#input-1]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `logGroupName` | string | Yes | CloudWatch log group name to search |
  | `filterPattern` | string | No | CloudWatch Logs filter pattern (e.g., "ERROR", "?ERROR ?Exception"). Matches all events if omitted. |
  | `logStreamNamePrefix` | string | No | Only search log streams whose name starts with this prefix |
  | `startTime` | number | No | Start time as Unix epoch seconds |
  | `endTime` | number | No | End time as Unix epoch seconds |
  | `startFromHead` | boolean | No | Return the earliest matching events first instead of the latest |
  | `limit` | number | No | Maximum number of events to return |

  #### Output [#output-1]

  | Parameter | Type | Description |
  | - | - | - |
  | `events` | array | Matching log events across all searched streams, sorted by timestamp |
  | ↳ `logStreamName` | string | Log stream the event belongs to |
  | ↳ `timestamp` | number | Event timestamp in epoch milliseconds |
  | ↳ `message` | string | Log event message |
  | ↳ `ingestionTime` | number | Ingestion time in epoch milliseconds |
</ReferenceDetails>

### CloudWatch Describe Log Groups [#cloudwatch-describe-log-groups]

List available CloudWatch log groups

<ReferenceDetails>
  #### Input [#input-2]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `prefix` | string | No | Filter log groups by name prefix |
  | `limit` | number | No | Maximum number of log groups to return |

  #### Output [#output-2]

  | Parameter | Type | Description |
  | - | - | - |
  | `logGroups` | array | List of CloudWatch log groups with metadata |
  | ↳ `logGroupName` | string | Log group name |
  | ↳ `arn` | string | Log group ARN |
  | ↳ `storedBytes` | number | Total stored bytes |
  | ↳ `retentionInDays` | number | Retention period in days (if set) |
  | ↳ `creationTime` | number | Creation time in epoch milliseconds |
</ReferenceDetails>

### CloudWatch Get Log Events [#cloudwatch-get-log-events]

Retrieve log events from a specific CloudWatch log stream

<ReferenceDetails>
  #### Input [#input-3]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `logGroupName` | string | Yes | CloudWatch log group name |
  | `logStreamName` | string | Yes | CloudWatch log stream name |
  | `startTime` | number | No | Start time as Unix epoch seconds |
  | `endTime` | number | No | End time as Unix epoch seconds |
  | `limit` | number | No | Maximum number of events to return |

  #### Output [#output-3]

  | Parameter | Type | Description |
  | - | - | - |
  | `events` | array | Log events with timestamp, message, and ingestion time |
  | ↳ `timestamp` | number | Event timestamp in epoch milliseconds |
  | ↳ `message` | string | Log event message |
  | ↳ `ingestionTime` | number | Ingestion time in epoch milliseconds |
</ReferenceDetails>

### CloudWatch Describe Log Streams [#cloudwatch-describe-log-streams]

List log streams within a CloudWatch log group

<ReferenceDetails>
  #### Input [#input-4]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `logGroupName` | string | Yes | CloudWatch log group name |
  | `prefix` | string | No | Filter log streams by name prefix |
  | `limit` | number | No | Maximum number of log streams to return |

  #### Output [#output-4]

  | Parameter | Type | Description |
  | - | - | - |
  | `logStreams` | array | List of log streams with metadata, sorted by last event time (most recent first) unless a prefix filter is applied |
  | ↳ `logStreamName` | string | Log stream name |
  | ↳ `lastEventTimestamp` | number | Timestamp of the last log event in epoch milliseconds |
  | ↳ `firstEventTimestamp` | number | Timestamp of the first log event in epoch milliseconds |
  | ↳ `creationTime` | number | Stream creation time in epoch milliseconds |
  | ↳ `storedBytes` | number | Total stored bytes |
</ReferenceDetails>

### CloudWatch Set Log Group Retention [#cloudwatch-set-log-group-retention]

Set (or clear, for never-expire) the retention period for a CloudWatch log group

<ReferenceDetails>
  #### Input [#input-5]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `logGroupName` | string | Yes | CloudWatch log group name |
  | `retentionInDays` | number | No | Days to retain log events (one of 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653). Omit to make events never expire. |

  #### Output [#output-5]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the retention policy was updated |
  | `logGroupName` | string | Log group the policy applies to |
  | `retentionInDays` | number | Retention period in days, or null if events never expire |
</ReferenceDetails>

### CloudWatch List Metrics [#cloudwatch-list-metrics]

List available CloudWatch metrics

<ReferenceDetails>
  #### Input [#input-6]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `namespace` | string | No | Filter by namespace (e.g., AWS/EC2, AWS/Lambda) |
  | `metricName` | string | No | Filter by metric name |
  | `recentlyActive` | boolean | No | Only show metrics active in the last 3 hours |
  | `limit` | number | No | Maximum number of metrics to return |

  #### Output [#output-6]

  | Parameter | Type | Description |
  | - | - | - |
  | `metrics` | array | List of metrics with namespace, name, and dimensions |
  | ↳ `namespace` | string | Metric namespace (e.g., AWS/EC2) |
  | ↳ `metricName` | string | Metric name (e.g., CPUUtilization) |
  | ↳ `dimensions` | array | Array of name/value dimension pairs |
</ReferenceDetails>

### CloudWatch Get Metric Statistics [#cloudwatch-get-metric-statistics]

Get statistics for a CloudWatch metric over a time range

<ReferenceDetails>
  #### Input [#input-7]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `namespace` | string | Yes | Metric namespace (e.g., AWS/EC2, AWS/Lambda) |
  | `metricName` | string | Yes | Metric name (e.g., CPUUtilization, Invocations) |
  | `startTime` | number | Yes | Start time as Unix epoch seconds |
  | `endTime` | number | Yes | End time as Unix epoch seconds |
  | `period` | number | Yes | Granularity in seconds (e.g., 60, 300, 3600) |
  | `statistics` | array | Yes | Statistics to retrieve (Average, Sum, Minimum, Maximum, SampleCount) |
  | `dimensions` | string | No | Dimensions as JSON (e.g., \{"InstanceId": "i-1234"}) |

  #### Output [#output-7]

  | Parameter | Type | Description |
  | - | - | - |
  | `label` | string | Metric label returned by CloudWatch |
  | `datapoints` | array | Datapoints sorted by timestamp with statistics values |
  | ↳ `timestamp` | number | Datapoint timestamp in epoch milliseconds |
  | ↳ `average` | number | Average statistic value |
  | ↳ `sum` | number | Sum statistic value |
  | ↳ `minimum` | number | Minimum statistic value |
  | ↳ `maximum` | number | Maximum statistic value |
  | ↳ `sampleCount` | number | Sample count statistic value |
  | ↳ `unit` | string | Unit of the metric |
</ReferenceDetails>

### CloudWatch Publish Metric [#cloudwatch-publish-metric]

Publish a custom metric data point to CloudWatch

<ReferenceDetails>
  #### Input [#input-8]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `namespace` | string | Yes | Metric namespace (e.g., Custom/MyApp) |
  | `metricName` | string | Yes | Name of the metric |
  | `value` | number | Yes | Metric value to publish |
  | `unit` | string | No | Unit of the metric (e.g., Count, Seconds, Bytes) |
  | `dimensions` | string | No | JSON string of dimension name/value pairs |

  #### Output [#output-8]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the metric was published successfully |
  | `namespace` | string | Metric namespace |
  | `metricName` | string | Metric name |
  | `value` | number | Published metric value |
  | `unit` | string | Metric unit |
  | `timestamp` | string | Timestamp when the metric was published |
</ReferenceDetails>

### CloudWatch Describe Alarms [#cloudwatch-describe-alarms]

List and filter CloudWatch alarms

<ReferenceDetails>
  #### Input [#input-9]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `alarmNamePrefix` | string | No | Filter alarms by name prefix |
  | `stateValue` | string | No | Filter by alarm state (OK, ALARM, INSUFFICIENT\_DATA) |
  | `alarmType` | string | No | Filter by alarm type (MetricAlarm, CompositeAlarm) |
  | `limit` | number | No | Maximum number of alarms to return |

  #### Output [#output-9]

  | Parameter | Type | Description |
  | - | - | - |
  | `alarms` | array | List of CloudWatch alarms with state and configuration |
  | ↳ `alarmName` | string | Alarm name |
  | ↳ `alarmArn` | string | Alarm ARN |
  | ↳ `stateValue` | string | Current state (OK, ALARM, INSUFFICIENT\_DATA) |
  | ↳ `stateReason` | string | Human-readable reason for the state |
  | ↳ `metricName` | string | Metric name (MetricAlarm only) |
  | ↳ `namespace` | string | Metric namespace (MetricAlarm only) |
  | ↳ `threshold` | number | Threshold value (MetricAlarm only) |
  | ↳ `stateUpdatedTimestamp` | number | Epoch ms when state last changed |
</ReferenceDetails>

### CloudWatch Describe Alarm History [#cloudwatch-describe-alarm-history]

Retrieve state-change and configuration history for CloudWatch alarms

<ReferenceDetails>
  #### Input [#input-10]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `alarmName` | string | No | Name of a specific alarm to retrieve history for. Omit for all alarms. |
  | `historyItemType` | string | No | Filter by history item type (ConfigurationUpdate, StateUpdate, Action, AlarmContributorStateUpdate, AlarmContributorAction) |
  | `startDate` | number | No | Start of the history window as Unix epoch seconds |
  | `endDate` | number | No | End of the history window as Unix epoch seconds |
  | `scanBy` | string | No | Sort order: TimestampDescending (newest first) or TimestampAscending |
  | `limit` | number | No | Maximum number of history records to return |

  #### Output [#output-10]

  | Parameter | Type | Description |
  | - | - | - |
  | `alarmHistoryItems` | array | Alarm history items sorted per scanBy, newest first by default |
  | ↳ `alarmName` | string | Name of the alarm this history item belongs to |
  | ↳ `alarmType` | string | MetricAlarm or CompositeAlarm |
  | ↳ `timestamp` | number | Epoch ms when the history item occurred |
  | ↳ `historyItemType` | string | ConfigurationUpdate, StateUpdate, Action, or contributor variants |
  | ↳ `historySummary` | string | Human-readable summary of the event |
</ReferenceDetails>

### CloudWatch Mute Alarm [#cloudwatch-mute-alarm]

Create a CloudWatch alarm mute rule that suppresses alarms for a fixed duration

<ReferenceDetails>
  #### Input [#input-11]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `muteRuleName` | string | Yes | Unique name for the mute rule (used later to unmute) |
  | `alarmNames` | array | Yes | Names of the CloudWatch alarms this mute rule targets |
  | `durationValue` | number | Yes | How long the mute lasts (paired with durationUnit) |
  | `durationUnit` | string | Yes | Unit for durationValue: minutes, hours, or days |
  | `description` | string | No | Optional description of why the alarms are being muted |
  | `startDate` | number | No | When the mute window begins as Unix epoch seconds. Defaults to now (mute starts immediately). |

  #### Output [#output-11]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the mute rule was created successfully |
  | `muteRuleName` | string | Name of the mute rule that was created |
  | `alarmNames` | array | Names of the alarms this rule mutes |
  | `expression` | string | Schedule expression used by the mute rule |
  | `duration` | string | ISO 8601 duration of the mute window |
</ReferenceDetails>

### CloudWatch Unmute Alarm [#cloudwatch-unmute-alarm]

Delete a CloudWatch alarm mute rule, restoring alarm notifications

<ReferenceDetails>
  #### Input [#input-12]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `awsRegion` | string | Yes | AWS region (e.g., us-east-1) |
  | `awsAccessKeyId` | string | Yes | AWS access key ID |
  | `awsSecretAccessKey` | string | Yes | AWS secret access key |
  | `muteRuleName` | string | Yes | Name of the mute rule to delete |

  #### Output [#output-12]

  | Parameter | Type | Description |
  | - | - | - |
  | `success` | boolean | Whether the mute rule was deleted successfully |
  | `muteRuleName` | string | Name of the mute rule that was deleted |
</ReferenceDetails>