Amazon CloudWatch Logs

Name: Amazon CloudWatch Logs API
Brand: Amazon CloudWatch Logs
Availability: InStock

★ Only Publicly Available OpenAPI DocumentDeveloper ToolsMonitoring Observabilityhmac48 EndpointsREST

For Agents

Ingest, query, and route log data across AWS workloads with retention, redaction, metric extraction, and Logs Insights queries.

Connect the Amazon CloudWatch Logs to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Amazon CloudWatch Logs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Amazon CloudWatch Logs API.

Create and manage log groups and streams via CreateLogGroup and CreateLogStream

Ingest log events with PutLogEvents

Run Logs Insights queries with StartQuery and GetQueryResults

Forward log events to Lambda or Kinesis through subscription filters

GET STARTED

Start building with Amazon CloudWatch Logs API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Amazon CloudWatch Logs, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Amazon CloudWatch Logs, keeping it validated and agent-ready. CloudWatch Logs ingests, stores, and queries log data from EC2 instances, Lambda functions, ECS tasks, CloudTrail, and many other AWS sources. Its 48-endpoint API covers log groups, log streams, metric filters, subscription filters that fan out to Lambda or Kinesis, Logs Insights query execution, export tasks to S3, data protection policies, and cross-account log destinations. It is the default observability sink for AWS workloads.

Use Cases

Patterns agents use Amazon CloudWatch Logs API for, with concrete tasks.

★ Logs Insights Investigation

Investigate production incidents by running Logs Insights queries across one or many log groups. The /StartQuery endpoint accepts a CloudWatch Logs Insights query string with filter, parse, stats, and sort commands and returns a queryId, which the application polls via /GetQueryResults until status is Complete. This is the default path for ad hoc log analysis on AWS without exporting data to a third-party tool.

Run a Logs Insights query 'fields @timestamp, @message | filter @message like /ERROR/' across log group '/aws/lambda/order-processor' for the last 1 hour

Log Routing to Downstream Systems

Forward selected log events to other systems for indexing, alerting, or third-party SIEM ingestion. Subscription filters route matching events to Kinesis Data Streams, Kinesis Firehose, or Lambda in near real time. Combined with destination policies, this supports cross-account routing into a central logging account without rewriting log shippers on every workload.

Create a subscription filter named 'errors-to-lambda' on log group '/aws/lambda/api' with filter pattern 'ERROR' and destination Lambda function arn:aws:lambda:us-east-1:123:function:siem-ingest

Log Archive and Retention

Hold logs in CloudWatch for a defined retention window, then archive to S3 for long-term storage at lower cost. The /CreateExportTask endpoint exports a log group between two timestamps to an S3 prefix, and PutRetentionPolicy enforces automatic deletion after a configurable duration. This pattern is common for cost control and regulatory archival of audit logs.

Export log group '/aws/cloudtrail' between 2026-05-01T00:00Z and 2026-06-01T00:00Z to bucket 'audit-archive' with prefix 'cloudtrail/2026-05'

AI Agent Observability Operations

AI agents call CloudWatch Logs through Jentic to investigate alerts by running Logs Insights queries, set up subscription filters when new services ship, and apply retention policies that match team standards. Through Jentic, the agent searches by intent, loads the operation schema, and executes with credentials stored in the vault. SigV4 signing happens inside Jentic so AWS keys never enter the agent context.

Search Jentic for 'query cloudwatch logs for errors', load the StartQuery schema, and run the query against the API service log group for the last hour

Key Endpoints

48 endpoints — jentic publishes the only available openapi specification for amazon cloudwatch logs, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/#X-Amz-Target=Logs_20140328.CreateLogGroup

Create a log group

POST

/#X-Amz-Target=Logs_20140328.CreateLogStream

Create a log stream

POST

/#X-Amz-Target=Logs_20140328.CreateExportTask

Export a log group to S3

POST

/#X-Amz-Target=Logs_20140328.DeleteLogGroup

Delete a log group

POST

/#X-Amz-Target=Logs_20140328.DeleteDestination

Delete a cross-account destination

POST

/#X-Amz-Target=Logs_20140328.AssociateKmsKey

Associate a KMS key for log group encryption

POST

/#X-Amz-Target=Logs_20140328.CreateLogGroup

Create a log group

POST

/#X-Amz-Target=Logs_20140328.CreateLogStream

Create a log stream

POST

/#X-Amz-Target=Logs_20140328.CreateExportTask

Export a log group to S3

POST

/#X-Amz-Target=Logs_20140328.DeleteLogGroup

Delete a log group

POST

/#X-Amz-Target=Logs_20140328.DeleteDestination

Delete a cross-account destination

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

AWS access keys for CloudWatch Logs are stored encrypted in the Jentic vault. Jentic performs SigV4 signing at execution time, so raw AWS secrets never enter the agent's context.

Intent-based discovery

Agents search Jentic by intent such as 'query cloudwatch logs for errors' or 'export cloudwatch logs to s3' and Jentic returns the matching CloudWatch Logs operation with its input schema, so the agent calls the right endpoint without parsing AWS docs.

Time to first call

Direct integration: 1-2 days to set up SigV4, IAM, and Logs Insights pagination. Through Jentic: under 1 hour — search, load the schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Amazon CloudWatch

Metrics, alarms, and dashboards

Pair with CloudWatch Logs for metric alarms derived from log-based metric filters

Complementary

Amazon EventBridge

Serverless event bus for AWS and SaaS sources

Combine with CloudWatch Logs when you need cross-service event routing in addition to log streaming

Alternative

Amazon Elasticsearch Service

Managed OpenSearch and Elasticsearch clusters

Pick OpenSearch when you need long-term log analytics with custom dashboards beyond Logs Insights

Complementary

Amazon Kinesis Analytics

Streaming SQL analytics over event streams

Use as a downstream consumer of CloudWatch Logs subscription filters that publish to Kinesis

FAQs

Specific to using Amazon CloudWatch Logs API through Jentic.

Why is there no official OpenAPI spec for Amazon CloudWatch Logs?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Amazon CloudWatch Logs via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the CloudWatch Logs API use?

CloudWatch Logs uses AWS Signature Version 4 (SigV4) HMAC request signing scoped to the logs IAM service. Through Jentic, AWS credentials sit in the encrypted vault and signing happens at execution time so the agent never sees the raw secret.

Can I run a Logs Insights query with the CloudWatch Logs API?

Yes. StartQuery accepts a query string written in the Logs Insights query language plus log group names and a time range, and returns a queryId. Poll GetQueryResults with that ID until status reaches Complete to retrieve the results.

How do I export logs to S3 through Jentic?

Search Jentic for 'export cloudwatch logs to s3', load the CreateExportTask schema, supply the log group name, time range, destination bucket, and prefix, and Jentic will sign and execute the call. Track progress via DescribeExportTasks.

What are the rate limits for the CloudWatch Logs API?

Per-region quotas apply, including default TPS limits on PutLogEvents, FilterLogEvents, and Logs Insights queries, plus account-wide caps on log groups and metric filters. Check the CloudWatch Logs service quotas in the AWS console for the values in your account.

Can the CloudWatch Logs API redact sensitive fields automatically?

Yes. PutDataProtectionPolicy attaches a JSON policy to a log group that identifies sensitive data types such as credit card numbers and email addresses, then masks them at ingest. Authorized principals can read the unmasked values via specific policy permissions.

Can I forward log events to a Lambda function?

Yes. PutSubscriptionFilter on a log group with a destination ARN pointing at a Lambda function streams matching log events to that function in near real time. The function must grant logs.amazonaws.com permission to invoke it.