AWS Amazon CloudWatch Logs
Browse all Amazonaws APIs★ Only Publicly Available OpenAPI DocumentDeveloper ToolsMonitoring Observabilityhmac48 EndpointsREST
For Agents
Ingest, query, and route log data across AWS workloads with retention, redaction, metric extraction, and Logs Insights queries.
Use for: I need to query application logs for errors in the last hour, Get log events from a specific log stream, List all log groups in a region, Set up a subscription filter to a Lambda function
Not supported: Does not handle metric storage, alarm evaluation, or distributed tracing — use for log ingestion, querying, retention, and routing only.
Jentic publishes the only available OpenAPI specification for Amazon CloudWatch Logs, keeping it validated and agent-ready. CloudWatch Logs ingests, stores, and queries log data from EC2 instances, Lambda functions, ECS tasks, CloudTrail, and many other AWS sources. Its 48-endpoint API covers log groups, log streams, metric filters, subscription filters that fan out to Lambda or Kinesis, Logs Insights query execution, export tasks to S3, data protection policies, and cross-account log destinations. It is the default observability sink for AWS workloads.
Install Jentic One Beta
Connect the Amazon CloudWatch Logs to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Amazon CloudWatch Logs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Amazon CloudWatch Logs API.
Create and manage log groups and streams via CreateLogGroup and CreateLogStream
Ingest log events with PutLogEvents
Run Logs Insights queries with StartQuery and GetQueryResults
Forward log events to Lambda or Kinesis through subscription filters
Export log data to S3 with CreateExportTask
Define metric filters that publish CloudWatch metrics from log patterns
Apply data protection policies that mask sensitive fields automatically
Use Cases
Patterns agents use Amazon CloudWatch Logs API for, with concrete tasks.
★ Logs Insights Investigation
Investigate production incidents by running Logs Insights queries across one or many log groups. The /StartQuery endpoint accepts a CloudWatch Logs Insights query string with filter, parse, stats, and sort commands and returns a queryId, which the application polls via /GetQueryResults until status is Complete. This is the default path for ad hoc log analysis on AWS without exporting data to a third-party tool.
Run a Logs Insights query 'fields @timestamp, @message | filter @message like /ERROR/' across log group '/aws/lambda/order-processor' for the last 1 hour
Log Routing to Downstream Systems
Forward selected log events to other systems for indexing, alerting, or third-party SIEM ingestion. Subscription filters route matching events to Kinesis Data Streams, Kinesis Firehose, or Lambda in near real time. Combined with destination policies, this supports cross-account routing into a central logging account without rewriting log shippers on every workload.
Create a subscription filter named 'errors-to-lambda' on log group '/aws/lambda/api' with filter pattern 'ERROR' and destination Lambda function arn:aws:lambda:us-east-1:123:function:siem-ingest
Log Archive and Retention
Hold logs in CloudWatch for a defined retention window, then archive to S3 for long-term storage at lower cost. The /CreateExportTask endpoint exports a log group between two timestamps to an S3 prefix, and PutRetentionPolicy enforces automatic deletion after a configurable duration. This pattern is common for cost control and regulatory archival of audit logs.
Export log group '/aws/cloudtrail' between 2026-05-01T00:00Z and 2026-06-01T00:00Z to bucket 'audit-archive' with prefix 'cloudtrail/2026-05'
AI Agent Observability Operations
AI agents call CloudWatch Logs through Jentic to investigate alerts by running Logs Insights queries, set up subscription filters when new services ship, and apply retention policies that match team standards. Through Jentic, the agent searches by intent, loads the operation schema, and executes with credentials stored in the vault. SigV4 signing happens inside Jentic so AWS keys never enter the agent context.
Search Jentic for 'query cloudwatch logs for errors', load the StartQuery schema, and run the query against the API service log group for the last hour
Key Endpoints
48 endpoints — jentic publishes the only available openapi specification for amazon cloudwatch logs, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/#X-Amz-Target=Logs_20140328.CreateLogGroup
Create a log group
POST
/#X-Amz-Target=Logs_20140328.CreateLogStream
Create a log stream
POST
/#X-Amz-Target=Logs_20140328.CreateExportTask
Export a log group to S3
POST
/#X-Amz-Target=Logs_20140328.DeleteLogGroup
Delete a log group
POST
/#X-Amz-Target=Logs_20140328.DeleteDestination
Delete a cross-account destination
POST
/#X-Amz-Target=Logs_20140328.AssociateKmsKey
Associate a KMS key for log group encryption
POST
/#X-Amz-Target=Logs_20140328.CreateLogGroup
Create a log group
POST
/#X-Amz-Target=Logs_20140328.CreateLogStream
Create a log stream
POST
/#X-Amz-Target=Logs_20140328.CreateExportTask
Export a log group to S3
POST
/#X-Amz-Target=Logs_20140328.DeleteLogGroup
Delete a log group
POST
/#X-Amz-Target=Logs_20140328.DeleteDestination
Delete a cross-account destination
POST
/#X-Amz-Target=Logs_20140328.AssociateKmsKey
Associate a KMS key for log group encryption
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
AWS access keys for CloudWatch Logs are stored encrypted in the Jentic vault. Jentic performs SigV4 signing at execution time, so raw AWS secrets never enter the agent's context.
Intent-based discovery
Agents search Jentic by intent such as 'query cloudwatch logs for errors' or 'export cloudwatch logs to s3' and Jentic returns the matching CloudWatch Logs operation with its input schema, so the agent calls the right endpoint without parsing AWS docs.
Time to first call
Direct integration: 1-2 days to set up SigV4, IAM, and Logs Insights pagination. Through Jentic: under 1 hour — search, load the schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Amazon CloudWatch Logs API through Jentic.
Why is there no official OpenAPI spec for Amazon CloudWatch Logs?
AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Amazon CloudWatch Logs via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the CloudWatch Logs API use?
CloudWatch Logs uses AWS Signature Version 4 (SigV4) HMAC request signing scoped to the logs IAM service. Through Jentic, AWS credentials sit in the encrypted vault and signing happens at execution time so the agent never sees the raw secret.
Can I run a Logs Insights query with the CloudWatch Logs API?
Yes. StartQuery accepts a query string written in the Logs Insights query language plus log group names and a time range, and returns a queryId. Poll GetQueryResults with that ID until status reaches Complete to retrieve the results.
How do I export logs to S3 through Jentic?
Search Jentic for 'export cloudwatch logs to s3', load the CreateExportTask schema, supply the log group name, time range, destination bucket, and prefix, and Jentic will sign and execute the call. Track progress via DescribeExportTasks.
What are the rate limits for the CloudWatch Logs API?
Per-region quotas apply, including default TPS limits on PutLogEvents, FilterLogEvents, and Logs Insights queries, plus account-wide caps on log groups and metric filters. Check the CloudWatch Logs service quotas in the AWS console for the values in your account.
Can the CloudWatch Logs API redact sensitive fields automatically?
Yes. PutDataProtectionPolicy attaches a JSON policy to a log group that identifies sensitive data types such as credit card numbers and email addresses, then masks them at ingest. Authorized principals can read the unmasked values via specific policy permissions.
Can I forward log events to a Lambda function?
Yes. PutSubscriptionFilter on a log group with a destination ARN pointing at a Lambda function streams matching log events to that function in near real time. The function must grant logs.amazonaws.com permission to invoke it.
GET STARTED