# Amazon CloudWatch Logs User Guide

> Monitor and store your log files from AWS sources. You can then retrieve the associated log data from CloudWatch Logs.

- [Log classes](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch_Logs_Log_Classes.md)
- [Optimize storage costs with Amazon CloudWatch Logs Intelligent Tiering](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/cwl_intelligent_tier.md)
- [Working with AWS SDKs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/sdk-general-information-section.md)
- [Analyzing log data with CloudWatch Log Analytics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogAnalytics.md)
- [Troubleshoot with CloudWatch Logs Live Tail](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs_LiveTail.md)
- [Cross-account cross-Region log centralization](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs_Centralization.md)
- [Access logs with S3 Tables Integration](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/s3-tables-integration.md)
- [Filter pattern syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.md)
- [Enable logging from third-party sources](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/enable-logging-third-party.md)
- [Streaming data to OpenSearch Service](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_OpenSearch_Stream.md)
- [Encrypt lookup tables using AWS KMS](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-lookup-tables-kms.md)
- [Logging API and console operations with AWS CloudTrail](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/logging_cw_api_calls_cwl.md)
- [Monitoring usage with CloudWatch metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Monitoring-CloudWatch-Metrics.md)
- [Service quotas](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/cloudwatch_limits_cwl.md)
- [Document history](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/DocumentHistory_cwl.md)
- [AWS Glossary](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/glossary.md)

## [What is Amazon CloudWatch Logs?](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.md)

- [Concepts](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogsConcepts.md): The terminology and concepts that are central to your understanding and use of CloudWatch Logs are described below.
- [Billing and costs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsBillingDetails.md): For detailed information about how to analyze your costs and usage for CloudWatch Logs and CloudWatch, and for best practices about how to reduce your costs, see CloudWatch billing and cost.


## [Getting started](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_GettingStarted.md)

- [Prerequisites](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/GettingSetup_cwl.md): Get started with Amazon CloudWatch Logs by ensuring that you have an AWS account and install the command line interface.
- [Using the unified CloudWatch agent](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/UseCloudWatchUnifiedAgent.md): How to use the unified CloudWatch agent to get started using CloudWatch Logs.

### [Using the previous CloudWatch agent](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/UsePreviousCloudWatchLogsAgent.md)

How to use the older CloudWatch Logs agent to get started using CloudWatch Logs.

- [Quick Start: Install the agent on a running EC2 Linux instance](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.md): Install and configure the CloudWatch Logs agent on an existing EC2 instance.
- [Quick Start: Install the agent on an EC2 Linux instance at launch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/EC2NewInstanceCWL.md): Install and configure the CloudWatch Logs agent when launching a new EC2 instance.
- [Quick Start: Use CloudWatch Logs with Windows Server 2016 instances](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartWindows2016.md): Enable your Windows Server 2016 instances to send logs to CloudWatch Logs.
- [Quick Start: Use CloudWatch Logs with Windows Server 2012 and Windows Server 2008 instances](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartWindows20082012.md): Enable your Windows Server 2012 and Windows Server 2008 instances to send logs to CloudWatch Logs.
- [Report the CloudWatch Logs agent status](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ReportCWLAgentStatus.md): Determine the current status of the CloudWatch Logs agent.
- [Start the CloudWatch Logs agent](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/StartTheCWLAgent.md): Start the CloudWatch Logs agent.
- [Stop the CloudWatch Logs agent](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/StopTheCWLAgent.md): Stop the CloudWatch Logs agent.
- [CloudWatch Logs agent reference](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.md): Describes the CloudWatch Logs agent.
- [Quick Start with CloudFormation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartCloudFormation.md): Use CloudFormation to provision CloudWatch Logs repeatedly across your web servers.


## [Log ingestion through HTTP endpoints](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_HTTP_Endpoints.md)

- [Bearer token authentication](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_HTTP_Endpoints_BearerTokenAuth.md): Set up bearer token authentication for sending logs to Amazon CloudWatch Logs through HTTP endpoints.
- [OTLP endpoint](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_HTTP_Endpoints_OTLP.md): Send logs to Amazon CloudWatch Logs using the OpenTelemetry Protocol (OTLP) endpoint with bearer token or SigV4 authentication.
- [HLC endpoint](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_HLC_Endpoint.md): Send logs to Amazon CloudWatch Logs using the HTTP Log Collector (HLC) endpoint.
- [NDJSON endpoint](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_HTTP_Endpoints_NDJSON.md): Send logs to Amazon CloudWatch Logs using the NDJSON (Newline Delimited JSON) endpoint.
- [Structured JSON endpoint](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_HTTP_Endpoints_StructuredJSON.md): Send logs to Amazon CloudWatch Logs using the Structured JSON endpoint.


## [Syslog ingestion](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_Syslog.md)

- [Setting up](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_Syslog_Setup.md): Set up Amazon CloudWatch Logs syslog ingestion by creating a VPC endpoint, log group, resource policy, and syslog configuration.
- [Device configuration](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_Syslog_DeviceConfig.md): Configure rsyslog, syslog-ng, and other syslog devices to send logs to Amazon CloudWatch Logs.
- [Monitoring](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_Syslog_Monitoring.md): Monitor your syslog ingestion pipeline using CloudWatch metrics published to the AWS/Logs namespace.
- [Sample queries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_Syslog_Queries.md): Use these CloudWatch Logs Insights sample queries to analyze syslog messages ingested into Amazon CloudWatch Logs.
- [VPC endpoint policies](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_Syslog_VPCEndpointPolicies.md): Control what traffic is allowed through your syslog VPC endpoint using endpoint policies.
- [Troubleshooting](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_Syslog_Troubleshooting.md): Resolve common issues with Amazon CloudWatch Logs syslog ingestion.


## [Log management](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogManagement.md)

- [Data source discovery and management](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/data-source-discovery-management.md): CloudWatch Logs automatically discovers and categorizes your log data by data source and type, making it easier to understand and manage your logs at scale.
- [Features enabled by data sources](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/features-enabled-by-data-sources.md): Data sources enable advanced log processing and analytics capabilities through field discovery and consistent data structures.

### [Supported data sources](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/supported-data-sources-catalog.md)

A comprehensive catalog of all data sources supported by CloudWatch Logs, including AWS services, third-party integrations, and custom sources.

- [Supported AWS services for data sources](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/supported-aws-services-data-sources.md): The following table lists the AWS services that are automatically categorized by CloudWatch Logs as data sources:
- [Supported third-party sources for data sources](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/supported-third-party-sources-data-sources.md): The following table lists the third-party sources that are automatically categorized by CloudWatch Logs as data sources when ingested through pipelines:
- [Custom sources](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/custom-data-sources.md): For custom application logs, you can define your own data source categorization using one of the following methods:


## [Analyzing log data with CloudWatch Logs Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.md)

### [Supported query languages](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_Languages.md)

The following sections list the commands supported in each query language.

### [CloudWatch Logs Insights query language (Logs Insights QL)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_LogsInsights.md)

This section includes full documentation of Logs Insights QL commands and functions.

### [CloudWatch Logs Insights language query syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.md)

This section provides details about the Logs Insights QL.

- [Logs Insights QL commands supported in log classes](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_Classes.md): All Logs Insights QL query commands are supported on log groups in the Standard log class.
- [addtotals](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Addtotals.md): Use addtotals to compute row totals and column totals for numeric fields.
- [anomaly](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Anomaly.md): Use anomaly to automatically identify unusual patterns and potential issues within your log data using machine learning.
- [display](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Display.md): Use display to show a specific field or fields in query results.
- [fields](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Fields.md): Use fields to show specific fields in query results.
- [filter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Filter.md): Use filter to get log events that match one or more conditions.
- [filterIndex](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-FilterIndex.md): Use filterIndex to return indexed data only, by forcing a query to scan only log groups that are indexed on a field that you specify in the query.
- [SOURCE](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Source.md): Including SOURCE in a query is a useful way to specify the log groups and/or data sources to include in a query when you are using the AWS CLI or API to create a query.
- [pattern](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Pattern.md): Use pattern to automatically cluster your log data into patterns.
- [diff](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Diff.md): Compares the log events found in your requested time period with the log events from a previous time period of equal length.
- [parse](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Parse.md): Use parse to extract data from a log field and create extracted fields that you can process in your query.
- [relevantfields](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-RelevantFields.md): Use relevantfields to automatically identify which fields in your log data are most relevant to a given condition.
- [expand](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Expand.md): Use expand to take a field containing a JSON array and create a separate log event for each element in the array.
- [sort](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Sort.md): Use sort to display log events in ascending (asc) or descending (desc) order by a specified field.
- [stats](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Stats.md): Use stats to create visualizations of your log data such as bar charts, line charts, and stacked area charts.
- [limit](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Limit.md): Use limit to specify the number of log events that you want your query to return.
- [dedup](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Dedup.md): Use dedup to remove duplicate results based on specific values in fields that you specify.
- [unmask](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Unmask.md): Use unmask to display all the content of a log event that has some content masked because of a data protection policy.
- [unnest](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Unnest.md): Use unnest to flatten a list taken as input to produce multiple records with a single record for each element in the list.
- [lookup](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Lookup.md): Use lookup to enrich your query results with reference data from a lookup table.
- [join](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Join.md): Combines log events from a source log group with events from another log group or query result based on a matching field.
- [subqueries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Subqueries.md): A subquery is a nested Logs Insights query that can be used as an input to another query.
- [autoregress](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Autoregress.md): Use the autoregress command to create lagged (previous-row) copies of a field's values.
- [logcompare](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Logcompare.md): Use the logcompare command to compare the current time window against a baseline window shifted back by a specified duration.
- [filldown](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Filldown.md): Use the filldown command to carry the last non-null value forward to fill gaps.
- [fillmissing](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Fillmissing.md): Use the fillmissing command to insert rows for empty time bins after stats ... by bin().
- [cidrlookup](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Cidrlookup.md): Use the cidrlookup command to enrich events by matching an IP field against CIDR ranges in a lookup table.
- [outlier](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Outlier.md): Use the outlier command to detect statistical outliers in numeric fields based on the interquartile range (IQR).
- [accum](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Accum.md): Use the accum command to compute a running cumulative sum of a numeric field.
- [appendcols](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Appendcols.md): Use the appendcols command to append a sub-query's columns to the current results by positional row matching.
- [sessionize](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Sessionize.md): Use the sessionize command to group events into sessions by identity fields and an inactivity gap.
- [countFrequent](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-CountFrequent.md): Use the countFrequent command (also available as count_frequent) to compute an approximate count of each unique field-value combination, sorted in descending order.
- [where](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Where.md): Use the where command as an alias for the filter command.
- [estimate](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Estimate.md): Use the estimate command to return the estimated bytes that the query would scan over the selected log groups and time range, without running the query.
- [Boolean, comparison, numeric, datetime, and other functions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-operations-functions.md): CloudWatch Logs Insights supports many other operations and functions in queries, as explained in the following sections.
- [Hashing functions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-hash-functions.md): You can use hashing functions in fields and filter commands.
- [Time-series functions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-timeseries-functions.md): Use time-series functions with the stats command to analyze metrics over time windows and compute rates of change.
- [Fields that contain special characters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-Guidelines.md): If a field contains non-alphanumeric characters other than the @ symbol or the period (.), you must surround the field with backtick characters (`).
- [Use aliases and comments in queries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-alias.md): Create queries that contain aliases.

### [Get started with Logs Insights QL: Query tutorials](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_Tutorials.md)

The following sections include sample query tutorials to help you get started with Logs Insights QL.

- [Tutorial: Run and modify a sample query](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_RunSampleQuery.md): The following tutorial helps you get started with CloudWatch Logs Insights.
- [Tutorial: Run a query with an aggregation function](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_AggregationQuery.md): You can use aggregation functions with the stats command and as arguments for other functions.
- [Tutorial: Run a query that produces a visualization grouped by log fields](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_VisualizationFieldQuery.md): When you run a query that uses the stats function to group the returned results by the values of one or more fields in the log entries, you can view the results as a bar chart, pie chart, line graph or stacked area graph.
- [Tutorial: Run a query that produces a time series visualization](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_VisualizationQuery.md): When you run a query that uses the bin() function to group the returned results by a time period, you can view the results as a line graph, stacked area graph, pie chart, or bar chart.
- [Sample queries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-examples.md): Lists useful examples of CloudWatch Logs Insights queries that illustrate the query syntax.
- [Compare (diff) with previous time ranges](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_Compare.md): Learn how to compare log events and patterns with those found in previous time periods in CloudWatch Logs.
- [Visualize log data in graphs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_Insights-Visualizing-Log-Data.md): Explains how to find patterns in your CloudWatch Logs data with visualizations such as graphs.
- [OpenSearch Piped Processing Language (PPL)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_PPL.md): This section contains a basic introduction to querying CloudWatch Logs using OpenSearch PPL.
- [OpenSearch Structured Query Language (SQL)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_SQL.md): This section contains a basic introduction to querying CloudWatch Logs using OpenSearch SQL.
- [Use natural language to generate and update CloudWatch Logs Insights queries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Insights-Query-Assist.md): Learn how to create queries using natural language .
- [Supported logs and discovered fields](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData-discoverable-fields.md): CloudWatch Logs Insights supports different log types.

### [Create field indexes to improve query performance and reduce scan volume](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing.md)

Learn how CloudWatch Logs indexes fields automatically and how to create field index policies to improve performance and reduce the scan volume of your CloudWatch Logs Insights queries.

- [Automatically indexed fields](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing-Automatic.md): Learn how CloudWatch Logs automatically indexes fields based on recent query activity and how to keep a field indexed permanently.
- [Field index syntax and quotas](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing-Syntax.md): You create field indexes by creating field index policies.
- [Create an account-level field index policy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing-CreateAccountLevel.md): Use the steps in this section to create a field index policy that applies to all log groups in the account, or to multiple log groups that have log group names that start with the same string.
- [Create a log-group level field index policy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing-CreateLogGroupLevel.md): Use the steps in this section to create a field index policy that applies to a single log group.
- [Log group selection options when creating a query](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Field-Indexing-Selection.md): This section explains the various ways that you can select log groups to include in a query.
- [Effects of deleting a field index policy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Field-Indexing-Deletion.md): If you delete a field index policy that has been in effect for a time, the following happens:
- [Use facets to group and explore logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Facets.md): Learn how to use facets to interactively filter and group your data without running queries.
- [Viewing surrounding logs in CloudWatch Logs Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_SurroundingLogs.md): Learn how to view surrounding log events for context around errors and other significant events in CloudWatch Logs Insights.
- [Pattern analysis](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_AnalyzeLogData_Patterns.md): Learn how to find and analyze patterns in your log events in CloudWatch Logs.
- [Save and re-run queries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_Insights-Saving-Queries.md): Explains how to save, run, and parameterize queries in CloudWatch Logs Insights.
- [Add query to dashboard or export query results](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_ExportQueryResults.md): How to add a CloudWatch Logs Insights query to a CloudWatch dashboard and how to export CloudWatch Logs Insights query results.
- [View running queries or query history](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Insights-Query-History.md): How to view CloudWatch Logs Insights query history and currently running queries.
- [Encrypt query results with AWS Key Management Service](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Insights-Query-Encrypt.md): Learn how to use a AWS KMS key to encrypt the results of your CloudWatch Logs Insights queries.
- [Generate a natural language summary from CloudWatch Logs Insights query results](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Insights-Query-Results-Summary.md): Learn how to generate an AI-powered natural language summary from CloudWatch Logs Insights query results.


## [Automating log analysis with scheduled queries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ScheduledQueries.md)

- [Understanding scheduled queries concepts](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/scheduled-queries-concepts.md): Before creating scheduled queries, understand these key concepts that affect how your queries run and where results are delivered.
- [Schedule expression reference](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/scheduled-queries-schedule-reference.md): Use these reference tables to construct schedule expressions for your scheduled queries.
- [Best practices](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/scheduled-queries-best-practices.md): Follow these best practices to ensure reliable and efficient scheduled query operations:

### [Getting started with scheduled queries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/scheduled-queries-getting-started.md)

When you create a scheduled query, you'll configure several key components that define how your query runs and where results are delivered.

- [Creating a scheduled query](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/create-scheduled-query.md): Create a scheduled query that automatically runs CloudWatch Logs Insights queries and delivers results to your chosen destinations.
- [Viewing and managing scheduled queries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/scheduled-queries-management.md): The following information is available for each query:
- [Viewing scheduled query execution history](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/scheduled-queries-execution-history.md): Use the execution history to monitor the performance of your scheduled queries and troubleshoot any issues with query execution or result delivery.
- [Updating a scheduled query](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/scheduled-queries-updating.md): Modify your scheduled query configuration to change the query string, schedule, destinations, or execution role as your requirements evolve.
- [Configuring S3 destinations for scheduled queries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/scheduled-queries-s3-destination.md): Configure Amazon S3 as a destination to store your scheduled query results as JSON files for long-term retention and analysis.
- [Configuring lookup table destinations for scheduled queries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/scheduled-queries-lookup-table-destination.md): Configure a lookup table as a destination to automatically refresh a lookup table with your scheduled query results.
- [Troubleshooting scheduled queries](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/scheduled-queries-troubleshooting.md): Use these troubleshooting topics to resolve common issues with scheduled queries.


## [Log anomaly detection](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection.md)

- [Using anomaly detection in CloudWatch Logs Insights](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection-Insights.md): In addition to creating log anomaly detectors for continuous monitoring, you can also use the anomaly command in CloudWatch Logs Insights queries to identify unusual patterns in your log data on-demand.
- [Enable anomaly detection on a log group](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection-Enable.md): Use the following steps to use the CloudWatch console to create a log anomaly detector that scans a log group for anomalies.
- [View anomalies that have been found](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection-View.md): After you create one or more log anomaly detectors, you can use the CloudWatch console to view the anomalies that they have found.
- [Create alarms on log anomaly detectors](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection-Alarms.md): You can create an alarm for a log anomaly detector in a log group.
- [Metrics published by log anomaly detectors](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection-Metrics.md): CloudWatch Logs publishes the AnomalyCount metric to CloudWatch metrics.
- [Encrypt an anomaly detector and its results with AWS KMS](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection-KMS.md): Anomaly detector data is always encrypted in CloudWatch Logs.


## [Working with log groups and log streams](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Working-with-log-groups-and-streams.md)

- [Search log data using filter patterns](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SearchDataFilterPattern.md): Search CloudWatch Logs data using filter patterns.
- [Protect log groups from deletion](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/protecting-log-groups-from-deletion.md): Enable deletion protection to prevent accidental deletion of important log groups.
- [Encrypt log data using AWS KMS](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.md): Enable AWS KMS encryption for CloudWatch Logs at the log group level.

### [Help protect sensitive log data with masking](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.md)

Explains how to protect sensitive data that appears in log groups in CloudWatch Logs by masking it.

- [Understanding data protection policies](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/cloudwatch-logs-data-protection-policies.md): Learn about data protection policies in CloudWatch Logs.
- [IAM permissions required to create or work with a data protection policy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/data-protection-policy-permissions.md): Learn what permissions you need to be able to create a data protection policy for a log group in CloudWatch Logs.
- [Create an account-wide data protection policy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data-accountlevel.md): Learn how to create a data protection policy to protect sensitive data in all CloudWatch Logs log groups in an AWS account.
- [Create a data protection policy for a single log group](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data-start.md): Learn how to create a data protection policy to protect sensitive data in CloudWatch Logs log groups.
- [View unmasked data](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data-viewunmasked.md): Learn how to view data that has been protected by a data protection policy in CloudWatch Logs log groups.
- [Audit findings reports](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data-audit-findings.md): Learn how to understand audit findings reports created with Amazon CloudWatch Logs data protection masking.

### [Types of data that you can protect](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/protect-sensitive-log-data-types.md)

Learn about what types of sensitive data in log files you can protect with masking, in CloudWatch Logs.

### [CloudWatch Logs managed data identifiers](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-managed-data-identifiers.md)

This section contains information about the types of data that you can protect using managed data identifiers, and which countries and regions are relevant for each of those types of data.

- [Credentials](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/protect-sensitive-log-data-types-credentials.md): CloudWatch Logs data protection can find the following types of credentials.
- [Device identifiers](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/protect-sensitive-log-data-types-device.md): CloudWatch Logs data protection can find the following types of device identifiers.
- [Financial information](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/protect-sensitive-log-data-types-financial.md): CloudWatch Logs data protection can find the following types of financial information.
- [Protected health information (PHI)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/protect-sensitive-log-data-types-health.md): CloudWatch Logs data protection can find the following types of protected health information (PHI).
- [Personally identifiable information (PII)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/protect-sensitive-log-data-types-pii.md): CloudWatch Logs data protection can find the following types of personally identifiable information (PII).
- [Custom data identifiers](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL-custom-data-identifiers.md): Learn how to create custom data identifiers to use to specify types of custom data to mask in CloudWatch Logs.


## [Transform logs during ingestion](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.md)

### [Create and manage log transformers](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Create.md)

A log transformer includes one or more processors that are in a logical pipeline together.

- [Create an account-level transformer policy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Transformer-CreateAccountLevel.md): Use the steps in this section to create a transformer policy that applies to all log groups in the account, or to multiple log groups that have log group names that start with the same string (prefix).
- [Edit or delete an account-level transformer policy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatchLogs-Transformer-EditAccountLevel.md): Use the steps in this section to edit or delete an account-level transformer policy.
- [Create a log-group-level log transformer from scratch](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-CreateNew.md): Use these steps to create a log-group-level transformer from scratch.
- [Create a log-group-level transformer by copying an existing one](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Copy.md): You can use the console to copy the JSON configuration of an existing transformer.
- [Edit a log-group-level transformer](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Edit.md): Use these steps to edit an existing log transformer.
- [Delete a log-group-level transformer](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Delete.md): Use these steps to delete a log transformer.
- [Configurable parser-type processors](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Configurable.md): This section contains information about the configurable data parser processors that you can use in a log event transformer.

### [Built-in processors for AWS vended logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-BuiltIn.md)

This section contains information about the built-in processors that you can use with AWS services that vend logs.

- [parseToOCSF](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-parseToOCSF.md): The parseToOCSF processor converts logs into Open Cybersecurity Schema Framework (OCSF) events.
- [String mutate processors](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-StringMutate.md): This section contains information about the string mutate processors that you can use with a log event transformer.
- [JSON mutate processors](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-JSONMutate.md): This section contains information about the JSON mutate processors that you can use with a log event transformer.
- [Datatype converter processors](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation-Datatype.md): This section contains information about the datatype converter processors that you can use with a log event transformer.
- [Transformation metrics and errors](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Transformation-Errors-Metrics.md): CloudWatch Logs publishes transformation metrics to CloudWatch.


## [Metric filters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.md)

- [Filter pattern syntax for metric filters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntaxForMetricFilters.md): Match terms and extract values in log events using metric filters and filter patterns in CloudWatch Logs.

### [Creating metric filters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringPolicyExamples.md)

Create metric filters based on examples to search log data using CloudWatch Logs.

- [Create a metric filter for a log group](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateMetricFilterProcedure.md): How to create a metric filter that publishes a metric to CloudWatch based on the contents of a log group.
- [Example: Count log events](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CountingLogEventsExample.md): CloudWatch Logs metric filter example that shows how to count log events.
- [Example: Count occurrences of a term](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CountOccurrencesExample.md): CloudWatch Logs metric filter example that shows how to count the occurrences of a word.
- [Example: Count HTTP 404 codes](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Counting404Responses.md): CloudWatch Logs metric filter example that shows how to count HTTP 404 responses.
- [Example: Count HTTP 4xx codes](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FindCountMetric.md): CloudWatch Logs metric filter example that shows how to count log events into a single metric.
- [Example: Extract fields from an Apache log and assign dimensions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ExtractBytesExample.md): CloudWatch Logs metric filter example that shows how to extract the number of bytes transferred from an Apache log.
- [Listing metric filters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ListingMetricFilters.md): List all CloudWatch Logs metric filters in a group.
- [Deleting a metric filter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/DeletingMetricFilter.md): Delete a CloudWatch Logs metric filter.


## [Subscription filters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Subscriptions.md)

- [Concepts](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/subscription-concepts.md): Each subscription filter is made up of the following key elements:
- [Log group-level subscription filters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters.md): Associate a subscription filter with a log group containing AWS CloudTrail events.
- [Account-level subscription filters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters-AccountLevel.md): Learn how to use account-level subscription filters in CloudWatch Logs.

### [Cross-account cross-Region subscriptions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CrossAccountSubscriptions.md)

Use CloudWatch Logs to share log data with cross-account subscriptions, using either Firehose or Amazon Kinesis.

### [Cross-account cross-Region log data sharing using Amazon Kinesis Data Streams](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CrossAccountSubscriptions-Kinesis.md)

Use CloudWatch Logs to share log data with cross-account subscriptions, using Amazon Kinesis Data Streams.

### [Setting up a new cross-account subscription](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Cross-Account-Log_Subscription-New.md)

Use Amazon Kinesis Data Streams to create a new subscription for cross-account CloudWatch Logs data sharing.

- [Step 1: Create a destination](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateDestination.md): Use Amazon Kinesis Data Streams to create a destination for cross-account CloudWatch Logs data.
- [Step 2: (Only if using an organization) Create an IAM role](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateSubscriptionFilter-IAMrole.md): Create an IAM role if you're using AWS Organizations with your cross-account log subscription.
- [Step 3: Add/validate IAM permissions for the cross-account destination](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Subscription-Filter-CrossAccount-Permissions.md): Explains how to validate IAM permissions when you set up a cross-account subscription with Amazon Kinesis Data Streams.
- [Step 4: Create a subscription filter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateSubscriptionFilter.md): Create a subscription filter so that cross-account users can send you their CloudWatch Logs events.
- [Validate the flow of log events](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ValidateLogEventFlow.md): Create a subscription filter so that cross-account users can send you their CloudWatch Logs events.
- [Modify destination membership at runtime](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ModifyDestinationMembership.md): Add or remove users from a cross-account subscription destination used by CloudWatch Logs.

### [Updating an existing cross-account subscription](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Cross-Account-Log_Subscription-Update.md)

How to update an existing subscription for cross-account CloudWatch Logs data sharing to use AWS Organizations.

- [Step 1: Update the subscription filters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Cross-Account-Log_Subscription-Update-filter.md)
- [Step 2: Update the existing destination access policy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Cross-Account-Log_Subscription-Update-policy.md): After you have updated the subscription filters in all of the sender accounts, you can update the destination access policy in the recipient account.

### [Cross-account cross-Region log data sharing using Firehose](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CrossAccountSubscriptions-Firehose.md)

Use CloudWatch Logs to share log data with cross-account subscriptions, using Firehose.

- [Step 1: Create a Firehose delivery stream](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateFirehoseStream.md)
- [Step 2: Create a destination](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateFirehoseStreamDestination.md)
- [Step 3: Add/validate IAM permissions for the cross-account destination](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Subscription-Filter-CrossAccount-Permissions-Firehose.md): Explains how to validate IAM permissions when you set up a cross-account subscription with Amazon Kinesis.
- [(Only if using an organization) Create an IAM role](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateSubscriptionFilterFirehose-IAMrole.md): Create an IAM role if you're using AWS Organizations with your cross-account log subscription.
- [Step 4: Create a subscription filter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateSubscriptionFilterFirehose.md): Create a subscription filter so that cross-account users can send you their CloudWatch Logs events using Firehose.
- [Validating the flow of log events](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ValidateLogEventFlowFirehose.md): Create a subscription filter so that cross-account users can send you their CloudWatch Logs events to a Firehose delivery stream in another account..
- [Modifying destination membership at runtime](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ModifyDestinationMembershipFirehose.md): Add or remove users from a cross-account subscription destination used by CloudWatch Logs.
- [Cross-account log data sharing using Lambda](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CrossAccountSubscriptions-Lambda.md): Use CloudWatch Logs to share log data with cross-account subscriptions, using AWS Lambda.

### [Cross-account cross-Region account-level subscriptions using Amazon Kinesis Data Streams](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CrossAccountSubscriptions-Kinesis-Account.md)

Use CloudWatch Logs at the account level to share log data with cross-account subscriptions, using Amazon Kinesis Data Streams.

### [Setting up a new cross-account subscription](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Cross-Account-Log_Subscription-New-Account.md)

Use Amazon Kinesis Data Streams to create a new subscription for cross-account CloudWatch Logs data sharing.

- [Step 1: Create a destination](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateDestination-Account.md): Use Amazon Kinesis Data Streams to create a destination for cross-account CloudWatch Logs data.
- [Step 2: (Only if using an organization) Create an IAM role](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateSubscriptionFilter-IAMrole-Account.md): Create an IAM role if you're using AWS Organizations with your cross-account log subscription.
- [Step 3: Create an account-level subscription filter policy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateSubscriptionFilter-Account.md): Create an account-level subscription filter so that cross-account users can send you their CloudWatch Logs events.
- [Validate the flow of log events](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ValidateLogEventFlow-Account.md): Create an account-level subscription filter policy so that cross-account users can send you their CloudWatch Logs events.
- [Modify destination membership at runtime](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ModifyDestinationMembership-Account.md): Add or remove users from a cross-account subscription destination used by CloudWatch Logs.

### [Updating an existing cross-account subscription](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Cross-Account-Log_Subscription-Update-Account.md)

How to update an existing subscription for cross-account CloudWatch Logs data sharing to use AWS Organizations.

- [Step 1: Update the subscription filters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Cross-Account-Log_Subscription-Update-filter-Account.md)
- [Step 2: Update the existing destination access policy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Cross-Account-Log_Subscription-Update-policy-Account.md): After you have updated the subscription filters in all of the sender accounts, you can update the destination access policy in the recipient account.

### [Cross-account cross-Region account-level subscriptions using Firehose](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CrossAccountSubscriptions-Firehose-Account.md)

Use CloudWatch Logs to share log data with cross-account subscriptions, using Firehose.

- [Step 1: Create a Firehose delivery stream](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateFirehoseStream-Account.md)
- [Step 2: Create a destination](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateFirehoseStreamDestination-Account.md)
- [Step 3: Create an account-level subscription filter policy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateSubscriptionFilterFirehose-Account.md): Create a subscription filter policy so that cross-account users can send you CloudWatch Logs events from all of their log groups using Firehose.
- [Validating the flow of log events](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ValidateLogEventFlowFirehose-Account.md): Create a subscription filter so that cross-account users can send you their CloudWatch Logs events to a Firehose delivery stream in another account..
- [Modifying destination membership at runtime](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/ModifyDestinationMembershipFirehose-Account.md): Add or remove users from a cross-account subscription destination used by CloudWatch Logs.
- [Confused deputy prevention](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Subscriptions-confused-deputy.md): How to guard against the confused deputy security problem in CloudWatch Logs subscriptions.
- [Log recursion prevention](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Subscriptions-recursion-prevention.md): Learn how to prevent infinite loops of log recursion when you set up subscription filters in CloudWatch Logs.


## [Enable logging from AWS services](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.md)

- [Supported log destinations and permissions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-destinations-table.md): Lists the supported destinations and permissions version for each AWS service that sends logs.

### [Logging that requires additional permissions [V1]](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-vended-logs-permissions.md)

Explains the permissions necessary for some AWS services to send their logs to CloudWatch Logs, Amazon S3, and Firehose.

- [Logs sent to CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-CWL.md)
- [Logs sent to Amazon S3](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-S3.md): When you set logs to be sent to Amazon S3, AWS creates or changes the resource policies associated with the S3 bucket that is receiving the logs, if needed.
- [Logs sent to Firehose](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-Firehose.md): This section applies when the types of logs listed in the table in the preceding section are sent to Firehose:

### [Logging that requires additional permissions [V2]](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-vended-logs-permissions-V2.md)

Explains the permissions necessary for some AWS services to send their logs to CloudWatch Logs, Amazon S3, Firehose, and X-Ray.

- [Logs sent to CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-V2-CloudWatchLogs.md): For an AWS CLI example, see Create a delivery to CloudWatch Logs.
- [Logs sent to Amazon S3](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-V2-S3.md): For an AWS CLI example, see Create a delivery to Amazon S3.
- [Logs sent to Firehose](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-V2-Firehose.md): For an AWS CLI example, see Create a delivery to Firehose.
- [Traces sent to X-Ray](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-V2-XRayTraces.md): For an AWS CLI example, see Create a delivery to X-Ray.
- [Service-specific permissions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-V2-service-specific.md): In addition to the destination-specific permissions listed in the previous sections, some services require explicit authorization that customers are allowed to send logs from their resources, as an additional layer of security.
- [Console-specific permissions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-infrastructure-V2-console.md): In addition to the permissions listed in the previous sections, if you are setting up log delivery using the console instead of the APIs, you also need the following additional permissions:
- [Cross-account delivery example](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/vended-logs-crossaccount-example.md): In this example, two accounts are involved.
- [Cross-service confused deputy prevention](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/cross-service-confused-deputy-prevention.md): The confused deputy problem is a security issue where an entity that doesn't have permission to perform an action can coerce a more-privileged entity to perform the action.
- [Automate log enablement with telemetry enablement rules](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/telemetry-enablement-rules.md): You can use telemetry enablement rules to automatically configure log collection for your AWS resources.


## [Exporting log data to Amazon S3](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3Export.md)

- [Export log data to Amazon S3 using the console](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasksConsole.md): Learn how to export logs to Amazon S3 using the AWS console.
- [Export log data to Amazon S3 using the AWS CLI](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasks.md): Learn how to export logs to Amazon S3 using the AWS CLI.
- [Describe export tasks (CLI)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/DescribeExportTasks.md): After you create an export task, you can get the current status of the task.
- [Cancel an export task (CLI)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CancelExportTask.md): You can cancel an export task if it's in a PENDING or RUNNING state.


## [Code examples](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/service_code_examples.md)

### [Basics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/service_code_examples_basics.md)

The following code examples show how to use the basics of CloudWatch Logs with AWS SDKs.

- [Hello CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_Hello_section.md): Hello CloudWatch Logs

### [Actions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/service_code_examples_actions.md)

The following code examples show how to use CloudWatch Logs with AWS SDKs.

- [AssociateKmsKey](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_AssociateKmsKey_section.md): Use AssociateKmsKey with an AWS SDK
- [CancelExportTask](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_CancelExportTask_section.md): Use CancelExportTask with an AWS SDK
- [CreateExportTask](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_CreateExportTask_section.md): Use CreateExportTask with an AWS SDK
- [CreateLogGroup](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_CreateLogGroup_section.md): Use CreateLogGroup with an AWS SDK or CLI
- [CreateLogStream](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_CreateLogStream_section.md): Use CreateLogStream with an AWS SDK or CLI
- [DeleteLogGroup](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_DeleteLogGroup_section.md): Use DeleteLogGroup with an AWS SDK or CLI
- [DeleteSubscriptionFilter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_DeleteSubscriptionFilter_section.md): Use DeleteSubscriptionFilter with an AWS SDK
- [DeleteSyslogConfiguration](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_DeleteSyslogConfiguration_section.md): Use DeleteSyslogConfiguration with an AWS SDK
- [DescribeExportTasks](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_DescribeExportTasks_section.md): Use DescribeExportTasks with an AWS SDK
- [DescribeLogGroups](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_DescribeLogGroups_section.md): Use DescribeLogGroups with an AWS SDK or CLI
- [DescribeLogStreams](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_DescribeLogStreams_section.md): Use DescribeLogStreams with an AWS SDK or CLI
- [DescribeSubscriptionFilters](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_DescribeSubscriptionFilters_section.md): Use DescribeSubscriptionFilters with an AWS SDK
- [GetLogEvents](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_GetLogEvents_section.md): Use GetLogEvents with an AWS SDK or CLI
- [GetQueryResults](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_GetQueryResults_section.md): Use GetQueryResults with an AWS SDK
- [ListSyslogConfigurations](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_ListSyslogConfigurations_section.md): Use ListSyslogConfigurations with an AWS SDK
- [PutResourcePolicy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_PutResourcePolicy_section.md): Use PutResourcePolicy with an AWS SDK
- [PutSubscriptionFilter](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_PutSubscriptionFilter_section.md): Use PutSubscriptionFilter with an AWS SDK
- [PutSyslogConfiguration](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_PutSyslogConfiguration_section.md): Use PutSyslogConfiguration with an AWS SDK
- [StartLiveTail](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_StartLiveTail_section.md): Use StartLiveTail with an AWS SDK or CLI
- [StartQuery](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_StartQuery_section.md): Use StartQuery with an AWS SDK

### [Scenarios](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/service_code_examples_scenarios.md)

The following code examples show how to use CloudWatch Logs with AWS SDKs.

- [Configure container service connectivity](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_ecs_ServiceConnect_085_section.md): Configure container service connectivity
- [Creating your first serverless function](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_lambda_GettingStarted_019_section.md): Creating your first serverless function
- [Learn syslog ingestion basics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_Scenario_SyslogIngestion_section.md): Learn CloudWatch Logs syslog ingestion basics using an AWS SDK
- [Run a large query](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cloudwatch-logs_Scenario_BigQuery_section.md): Use CloudWatch Logs to run a large query
- [Use scheduled events to invoke a Lambda function](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/example_cross_LambdaScheduledEvents_section.md): Use scheduled events to invoke a Lambda function


## [Security](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/security.md)

- [Data protection](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/data-protection.md): Learn how the AWS shared responsibility model applies to data protection in Amazon CloudWatch Logs.

### [Identity and access management](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/auth-and-access-control-cwl.md)

Control user access using IAM policies to specify which CloudWatch Logs actions a user in your AWS account can perform.

- [Overview of managing access](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.md): Describes how account administrators can manage access to resources by attaching permissions policies to IAM identities.

### [Using identity-based policies (IAM policies)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-identity-based-access-control-cwl.md)

Provides examples of IAM identity-based policies for controlling access to Amazon CloudWatch Logs.

- [CloudWatch Logs permissions reference](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/permissions-reference-cwl.md): Describes the Amazon CloudWatch Logs API operations and the corresponding actions you grant permissions to perform.
- [Using service-linked roles](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/using-service-linked-roles-cwl.md): How to use service-linked roles to give CloudWatch Logs access to resources in your AWS account.
- [Policy updates](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/cwl-slrpolicy-updates.md)
- [Compliance validation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/compliance-validation.md): Learn what AWS services are in scope of a specific compliance program.
- [Resilience](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/disaster-recovery-resiliency.md): Learn how AWS architecture supports data redundancy, and learn about specific Amazon CloudWatch Logs features for data resiliency.
- [Infrastructure security](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/infrastructure-security.md): Learn how Amazon CloudWatch Logs isolates service traffic.
- [Interface VPC endpoints](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/cloudwatch-logs-and-interface-VPC.md): Explains how to use CloudWatch Logs with interface VPC endpoints.


## Full content

The entire guide is also available as a single markdown file, useful for feeding the full guide to an LLM in one pass:

- [Complete guide (single file)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/full.md)