canonical: https://jentic.com/apis/amazonaws.com/logs # AWS Amazon CloudWatch Logs Jentic publishes the only available OpenAPI specification for Amazon CloudWatch Logs, keeping it validated and agent-ready. CloudWatch Logs ingests, stores, and queries log data from EC2 instances, Lambda functions, ECS tasks, CloudTrail, and many other AWS sources. Its 48-endpoint API covers log groups, log streams, metric filters, subscription filters that fan out to Lambda or Kinesis, Logs Insights query execution, export tasks to S3, data protection policies, and cross-account log destinations. It is the default observability sink for AWS workloads. ## For AI agents Ingest, query, and route log data across AWS workloads with retention, redaction, metric extraction, and Logs Insights queries. ## Scope Does not handle metric storage, alarm evaluation, or distributed tracing - use for log ingestion, querying, retention, and routing only. ## Capabilities - Create and manage log groups and streams via CreateLogGroup and CreateLogStream - Ingest log events with PutLogEvents - Run Logs Insights queries with StartQuery and GetQueryResults - Forward log events to Lambda or Kinesis through subscription filters - Export log data to S3 with CreateExportTask - Define metric filters that publish CloudWatch metrics from log patterns - Apply data protection policies that mask sensitive fields automatically ## Use cases ### Logs Insights Investigation Investigate production incidents by running Logs Insights queries across one or many log groups. The /StartQuery endpoint accepts a CloudWatch Logs Insights query string with filter, parse, stats, and sort commands and returns a queryId, which the application polls via /GetQueryResults until status is Complete. This is the default path for ad hoc log analysis on AWS without exporting data to a third-party tool. Example prompt: Run a Logs Insights query 'fields @timestamp, @message | filter @message like /ERROR/' across log group '/aws/lambda/order-processor' for the last 1 hour ### Log Routing to Downstream Systems Forward selected log events to other systems for indexing, alerting, or third-party SIEM ingestion. Subscription filters route matching events to Kinesis Data Streams, Kinesis Firehose, or Lambda in near real time. Combined with destination policies, this supports cross-account routing into a central logging account without rewriting log shippers on every workload. Example prompt: Create a subscription filter named 'errors-to-lambda' on log group '/aws/lambda/api' with filter pattern 'ERROR' and destination Lambda function arn:aws:lambda:us-east-1:123:function:siem-ingest ### Log Archive and Retention Hold logs in CloudWatch for a defined retention window, then archive to S3 for long-term storage at lower cost. The /CreateExportTask endpoint exports a log group between two timestamps to an S3 prefix, and PutRetentionPolicy enforces automatic deletion after a configurable duration. This pattern is common for cost control and regulatory archival of audit logs. Example prompt: Export log group '/aws/cloudtrail' between 2026-05-01T00:00Z and 2026-06-01T00:00Z to bucket 'audit-archive' with prefix 'cloudtrail/2026-05' ### AI Agent Observability Operations AI agents call CloudWatch Logs through Jentic to investigate alerts by running Logs Insights queries, set up subscription filters when new services ship, and apply retention policies that match team standards. Through Jentic, the agent searches by intent, loads the operation schema, and executes with credentials stored in the vault. SigV4 signing happens inside Jentic so AWS keys never enter the agent context. Example prompt: Search Jentic for 'query cloudwatch logs for errors', load the StartQuery schema, and run the query against the API service log group for the last hour ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /#X-Amz-Target=Logs_20140328.CreateLogGroup | Create a log group | | POST | /#X-Amz-Target=Logs_20140328.CreateLogStream | Create a log stream | | POST | /#X-Amz-Target=Logs_20140328.CreateExportTask | Export a log group to S3 | | POST | /#X-Amz-Target=Logs_20140328.DeleteLogGroup | Delete a log group | | POST | /#X-Amz-Target=Logs_20140328.DeleteDestination | Delete a cross-account destination | | POST | /#X-Amz-Target=Logs_20140328.AssociateKmsKey | Associate a KMS key for log group encryption | ## Key resources - **Log Groups** — Create, list, and configure retention on log groups - **Log Streams** — Create streams and ingest log events - **Logs Insights Queries** — Start, stop, describe, and fetch results of queries - **Subscription Filters** — Route log events to Lambda, Kinesis, or Firehose - **Metric Filters** — Publish CloudWatch metrics derived from log patterns - **Data Protection Policies** — Mask or redact sensitive fields at ingest and on read ## Why Jentic - **Setup:** Wiring CloudWatch Logs by hand means implementing AWS SigV4 request signing against the logs service, picking the right regional host such as logs.eu-west-1.amazonaws.com, and handling per-region throttling with your own backoff. Through Jentic you install once, import Amazon CloudWatch Logs from the API Directory, store the AWS access key once, and your agent calls it. - **Permission scoping:** CloudWatch Logs carries log group names in the request body rather than the URL path, so scoping is by operation, not by path prefix. Limit the agent to the operations it needs, such as StartQuery and GetQueryResults for read-only investigation, and leave destructive ones like DeleteLogGroup or DeleteDestination out unless you add them. - **Credential handling:** Your AWS access key is stored once, encrypted, by your own Jentic One instance and used to sign each CloudWatch Logs request with SigV4 at execution time. The raw secret never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'query cloudwatch logs for errors' or 'export cloudwatch logs to s3', and Jentic returns the matching CloudWatch Logs operation with its input schema so the agent calls the right endpoint without parsing the AWS reference. ## Related APIs - **Amazon CloudWatch** — Metrics, alarms, and dashboards - **Amazon EventBridge** — Serverless event bus for AWS and SaaS sources - **Amazon Elasticsearch Service** — Managed OpenSearch and Elasticsearch clusters - **Amazon Kinesis Analytics** — Streaming SQL analytics over event streams ## FAQ ### Why is there no official OpenAPI spec for Amazon CloudWatch Logs? AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Amazon CloudWatch Logs via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the CloudWatch Logs API use? CloudWatch Logs uses AWS Signature Version 4 (SigV4) HMAC request signing scoped to the logs IAM service. Through Jentic, AWS credentials sit in the encrypted vault and signing happens at execution time so the agent never sees the raw secret. ### Can I run a Logs Insights query with the CloudWatch Logs API? Yes. StartQuery accepts a query string written in the Logs Insights query language plus log group names and a time range, and returns a queryId. Poll GetQueryResults with that ID until status reaches Complete to retrieve the results. ### How do I export logs to S3 through Jentic? Search Jentic for 'export cloudwatch logs to s3', load the CreateExportTask schema, supply the log group name, time range, destination bucket, and prefix, and Jentic will sign and execute the call. Track progress via DescribeExportTasks. ### What are the rate limits for the CloudWatch Logs API? Per-region quotas apply, including default TPS limits on PutLogEvents, FilterLogEvents, and Logs Insights queries, plus account-wide caps on log groups and metric filters. Check the CloudWatch Logs service quotas in the AWS console for the values in your account. ### Can the CloudWatch Logs API redact sensitive fields automatically? Yes. PutDataProtectionPolicy attaches a JSON policy to a log group that identifies sensitive data types such as credit card numbers and email addresses, then masks them at ingest. Authorized principals can read the unmasked values via specific policy permissions. ### Can I forward log events to a Lambda function? Yes. PutSubscriptionFilter on a log group with a destination ARN pointing at a Lambda function streams matching log events to that function in near real time. The function must grant logs.amazonaws.com permission to invoke it. ### Can I limit what my agent is allowed to do with the CloudWatch Logs API? Yes. Because you run Jentic One yourself, your own rules decide which CloudWatch Logs operations and credentials the agent may use. CloudWatch Logs carries log group names in the request body rather than the URL path, so you scope by operation rather than by path prefix: grant only what the agent needs, such as StartQuery and GetQueryResults for read-only investigation. Destructive operations like DeleteLogGroup and DeleteDestination stay off the agent's list unless you explicitly add them.