Get the logs

For your information

You can retrieve logs of balancers and cloud database clusters for which logging is enabled. You can also retrieve logs that you have added yourself.

You can get a list of log groups, a list of event streams and events.

Getting logs is possible:

through the control panel;
using the AWS CLI;
or SDK client.

You can also export logs to your own storage using the Fluent Bit plugin and Grafana Alloy agent.

The address (URL) of the Logi service in the desired pool can be viewed in the URL list.

Get a list of log groups

Control panel
SDK client
AWS CLI

In the dashboard, on the top menu, click Products and select Logs.
Go to the Logs section.
Select a region and pool.

For your information

The service does not support the logGroupClass, includeLinkedAccounts, accountIdentifiers, and logGroupIdentifiers parameters to retrieve a list of log groups. For more information about log group parameters, see the DescribeLogGroups instruction in the official AWS documentation.

Python
Go

Open the script file. If you do not already have a script file, create a new one.
Add a script to get the log groups into a file:
```
response = client.describe_log_groups(
    # logGroupNamePrefix='<log_group_name_prefix>',
    # logGroupNamePattern='<log_group_name_pattern>',
    # nextToken='<next_token>',
    limit=<log_groups_number>,
)

print(response['logGroups'])
print(response.get('nextToken'))
```
Specify:
- Optional: <log_group_group_name_prefix> - log group prefix, for example s/lbaas/;Do not specify the logGroupNamePrefix parameter if you passed the logGroupNamePattern parameter ;
- optional: <log_group_name_pattern> - log group name pattern for filtering. The parameter is case sensitive. Log groups whose names match the specified value will be displayed in the response. For example, if you specify lbaas, the response will display log groups named lbaas, s/lbaas. Do not specify the logGroupNamePattern parameter if you passed the logGroupNamePrefix parameter;
- optional: <next_token> - the token for the next set of returned groups that you received in response to a past request;
- <log_groups_number> - maximum number of groups in the response, e.g. 10. If no value is specified, 50 groups will be returned by default. If no groups are found, you will get an empty list. Example answer:

Run the script. In the response you will get:

empty list if there is no log group. Example answer:
```
{"logGroups":[]}
```

log group list. Example answer:

{
    "logGroups": [
        {
            "logGroupName": "s/lbaas/Bellatrix-lb",
            "creationTime": 1742663023757
        },
        {
            "logGroupName": "group-name",
            "creationTime": 1738779717218
        },
        {
            "logGroupName": "s/lbaas/test-lb-for-logs",
            "creationTime": 1743073180613
        }
    ]
}

list of log groups and nextToken if there are more groups. You can use the token in the query to get the next page of results. Example response:
```
{
    "logGroups": [...],
    "nextToken": 'string'
}
```

Open the script file. If you do not already have a script file, create a new one.
Add a script to get the log groups into a file:
```
  input := &cloudwatchlogs.DescribeLogGroupsInput{
    // LogGroupNamePrefix: aws.String("<log_group_name_prefix>"),
    // LogGroupNamePattern: aws.String("<log_group_name_pattern>"),
    // NextToken: aws.String("<next_token>"),
    Limit: aws.Int32(log_<groups_number>),
  }

  resp, err := client.DescribeLogGroups(context.TODO(), input)
  if err != nil {
    log.Fatalf("Ошибка DescribeLogGroups: %v", err)
  }

  fmt.Printf("Response: %+v\n", resp)
```
Specify:
- Optional: <log_group_group_name_preffix> - log group prefix, for example s/lbaas/;Do not specify the logGroupNamePrefix parameter if you passed the logGroupNamePattern parameter ;
- optional: <log_group_name_pattern> - log group name pattern for filtering. The parameter is case sensitive. Log groups whose names match the specified value will be displayed in the response. For example, if you specify lbaas, the response will display log groups named lbaas, s/lbaas. Do not specify the logGroupNamePattern parameter if you passed the logGroupNamePrefix parameter;
- optional: <next_token> - the token for the next set of returned groups that you received in response to a past request;
- <log_groups_number> - maximum number of groups in the response, e.g. 10. If no value is specified, 50 groups will be returned by default.

Run the script. In the response you will get:

empty list if there is no log group. Example answer:
```
{"logGroups":[]}
```

log group list. Example answer:

{
    "logGroups": [
        {
            "logGroupName": "s/lbaas/Bellatrix-lb",
            "creationTime": 1742663023757
        },
        {
            "logGroupName": "group-name",
            "creationTime": 1738779717218
        },
        {
            "logGroupName": "s/lbaas/test-lb-for-logs",
            "creationTime": 1743073180613
        }
    ]
}

list of log groups and nextToken if there are more groups. You can use the token in the query to get the next page of results. Example response:
```
{
    "logGroups": [...],
    "nextToken": 'string'
}
```

For your information

Open the CLI.
To retrieve log groups, run the command:
```
aws logs describe-log-groups
```

Get a list of event streams

Control panel
SDK client
AWS CLI

In the dashboard, on the top menu, click Products and select Logs.
Go to the Logs section.
Select a region and pool.
Optional: select the product of the log group.
Open the log group page.

For your information

The service does not support the logGroupIdentifier, descending, and orderBy parameters for retrieving a list of event streams. For more information about event stream parameters, see the DescribeLogStreams instruction in the AWS official documentation.

Python
Go

Open the script file. If you do not already have a script file, create a new one.
Add a script to get event streams into a file:
```
response = client.describe_log_streams(
    logGroupName='<log_group_name>',
    # nextToken='<next_token>',
    limit=<streams_number>,
)

print(response['logGroups'])
print(response.get('nextToken'))
```
Specify:
- <log_group_name> - log group name, e.g. s/lbaas/Bellatrix-lb;
- optional: <next_token> - the token for the next set of returned streams that you received in response to a past request;
- <streams_number> - maximum number of streams in the response, e.g. 10. If no value is specified, 50 streams will be returned by default.

Run the script. In the response you will get:

empty list if there are no streamers in the log group. Example answer:
```
{"logStreamName":[]}
```

list of streamers in the log group. Example answer:

{
    "logStreamName": [
        {
            "logStreamName": "pgbouncer.log-2a682d5d-dea9-48bc-8850-0c332c574f4e", 
            "creationTime": 1755619440620
        },
        {
            "logGroupName": "stream-name",
            "creationTime": 1755619440634
        }
    ]
}

list of streams and nextToken if there are more streams. You can use the token in the request to get the next page of results. Example response:
```
{
    "logStreamName": [...],
    "nextToken": "string"
}
```

Open the script file. If you do not already have a script file, create a new one.

Add a script to get event streams into a file:

input := &cloudwatchlogs.DescribeLogStreamsInput{
  LogGroupName: aws.String("<log_group_name>"),
  // NextToken: aws.String("<next_token>"),
  Limit:        aws.Int32(<streams_number>),
}

resp, err := client.DescribeLogStreams(context.TODO(), input)
if err != nil {
log.Fatalf("Ошибка DescribeLogStreams: %v", err)
}

fmt.Printf("Response: %+v\n", resp)

Specify:

<log_group_name> - log group name, e.g. s/lbaas/Bellatrix-lb;
optional: <next_token> - the token for the next set of returned streams that you received in response to a past request;
<streams_number> - maximum number of streams in the response, e.g. 10. If no value is specified, 50 streams will be returned by default.

Run the script. In the response you will get:

empty list if there are no streamers in the log group. Example answer:
```
{"logStreamName":[]}
```

list of streamers in the log group. Example answer:

{
    "logStreamName": [
        {
            "logStreamName": "pgbouncer.log-2a682d5d-dea9-48bc-8850-0c332c574f4e", 
            "creationTime": 1755619440620
        },
        {
            "logGroupName": "stream-name",
            "creationTime": 1755619440634
        }
    ]
}

list of streams and nextToken if there are more streams. You can use the token in the request to get the next page of results. Example response:
```
{
    "logStreamName": [...],
    "nextToken": "string"
}
```

For your information

Open the CLI.
To get event streams, run the command:
```
aws logs describe-log-streams --log-group-name <log_group_name>
```
Specify <log_group_name> - log group name, for example s/lbaas/Bellatrix-lb.

Get events

Control panel
SDK client
AWS CLI

In the dashboard, on the top menu, click Products and select Logs.
Go to the Logs section.
Select a region and pool.
Optional: select the product of the log group.
Open the log group page.
Select Stream.
Optional: filter the events.

For your information

The service does not support the logGroupIdentifier and unmask parameters for receiving events. For more information about event parameters, see the GetLogEvents instructions in the AWS official documentation.

Python
Go

Open the script file. If you do not already have a script file, create a new one.
Add a script to fetch events to a file:
```
response = client.get_log_events(
    logGroupName='<log_group_name>',
    logStreamName='<stream_name>',
    # nextBackwardToken='<back_token>',
    # nextForwardToken='<next_token>',
    limit=<events_number>
)

print(response)
```
Specify:
- <log_group_name> - log group name, e.g. s/lbaas/Bellatrix-lb;
- <log_stream_name> - event stream name, e.g. http-b964dde5-7080-4169-8f9e-127bd59c89ca;
- optional: <back_token> - the token for the previous set of returned events that you received in response to a past request;
- optional: <next_token> - the token for the next set of returned events that you received in response to a past request;
- <events_number> - maximum number of log events in the response. The minimum value of events in the response is 1, the maximum value is 10000. If no limit is specified, the default number of events in the response is 1 MB (up to 10,000 events).

Run the script. In the response you will get:

empty list, if there are no events in the stream. Example answer:
```
{"events":[]}
```

list of stream events. Example answer:

{
    "events": [
        {
            "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
            "ingestion": 1742920694862,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687071
        },
        {
            "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
            "ingestion": 1742920697233,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687061
        }
    ]
}

event list, nextBackwardToken or nextForwardToken if there are more events. You can use the token in the query to get the previous or next page of results. Example response:
```
{
    "events": [...],
    "nextBackwardToken": "string",
    "nextForwardToken": "string"
}
```

Open the script file. If you do not already have a script file, create a new one.
Add a script to fetch events to a file:
```
input := &cloudwatchlogs.GetLogEventsInput{
    LogGroupName: aws.String("<log_group_name>"),
    LogStreamName: aws.String("<log_stream_name>"),
    // NextBackwardToken: aws.String("<back_token>"),
    // NextForwardToken: aws.String("<next_token>"),
    Limit: aws.Int32(<events_number>),
}

resp, err := client.GetLogEvents(context.TODO(), input)
if err != nil {
    log.Fatalf("Ошибка GetLogEvents: %v", err)
}

fmt.Printf("Response: %+v\n", resp)
```
Specify:
- <log_group_name> - log group name, e.g. s/lbaas/Bellatrix-lb;
- <log_stream_name> - event stream name, e.g. http-b964dde5-7080-4169-8f9e-127bd59c89ca;
- optional: <back_token> - the token for the previous set of returned events that you received in response to a past request;
- optional: <next_token> - the token for the next set of returned events that you received in response to a past request;
- <events_number> - maximum number of log events returned, e.g. 10. The minimum value of events in the response is 1, and the maximum value is 10000. If no limit is specified, the default number of events in the response is 1 MB (up to 10,000 events).

Run the script. In the response you will get:

empty list, if there are no events in the stream. Example answer:
```
{"events":[]}
```

list of stream events. Example answer:

{
    "events": [
        {
            "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
            "ingestion": 1742920694862,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687071
        },
        {
            "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
            "ingestion": 1742920697233,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687061
        }
    ]
}

event list, nextBackwardToken or nextForwardToken if there are more events. You can use the token in the query to get the previous or next page of results. Example response:
```
{
    "events": [...],
    "nextBackwardToken": "string",
    "nextForwardToken": "string"
}
```

For your information

Open the CLI.
To retrieve the events, run the command:
```
aws logs get-log-events --log-group-name  <log_group_name> --log-stream-name <log_stream_name>
```
Specify:
- <log_group_name> - log group name, e.g. s/lbaas/Bellatrix-lb;
- <log_stream_name> - event stream name, e.g. http-b964dde5-7080-4169-8f9e-127bd59c89ca.

Filter events

Control panel
SDK client
AWS CLI

In the dashboard, on the top menu, click Products and select Logs.
Go to the Logs section.
Select a region and pool.
Optional: select the product of the log group.
Open the log group page.
Select Stream.
In the search box, enter the value that the events contain. You can use filter patterns to match terms in unstructured log events. For more information, see Using filter patterns to match terms in unstructured log events in the official AWS documentation.

Examples of values in the search box and search results from the filter pattern:
- errors - events that contain error;
- error timeout - events that contain error and timeout;
- ?500 ?404 - will display events that contain 500 or 404;
- error -timeout - events that contain error but do not contain timeout;
- "internal server error" - events with an exact match of the value will be output.
Optional: select UTC Time or Local Time for the displayed event time.
Specify a time period to filter events.

For your information

The service does not support the interleaved, logGroupIdentifier, and unmask parameters for event filtering. For more information about event filtering parameters, see the FilterLogEvents instructions in the official AWS documentation.

Python
Go

Open the script file. If you do not already have a script file, create a new one.
Add a script to filter events to the file:
```
response = client.filter_log_events(
    logGroupName='<log_group_name>',
    # endTime=<timestamp>,
    # nextToken='<next_token>',
    limit=<events_number>
)

print(response['events'])
print(response.get('nextToken'))
```
Specify:
- <log_group_name> - log group name, e.g. s/lbaas/Bellatrix-lb;
- optional: <timestamp> - end of time range in timestamp format;
- <events_number> - maximum number of log events returned, e.g. 10. The minimum value of events in the response is 1, and the maximum value is 10000. If no limit is specified, the default number of events in the response is 1 MB (up to 10,000 events);
- optional: <next_token> - the token for the next set of returned events that you received in response to a past request.

Run the script. In the response you will get:

empty list, if there are no events in the stream. Example answer:
```
{"events":[]}
```

event list. Example answer:

{
    "events": [
        {
            "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
            "ingestion": 1742920694862,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687071
        },
        {
            "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
            "ingestion": 1742920697233,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687061
        }
    ]
}

list of events and nextToken if there are more events. You can use the token in the request to get the next page of results. Example response:
```
{
    "events": [...],
    "nextToken": "string"
}
```

Open the script file. If you do not already have a script file, create a new one.
Add a script to filter events to the file:
```
input := &cloudwatchlogs.GetLogEventsInput{
    LogGroupName=aws.String("stging"),
    // EndTime=aws.Int64(<timestamp>),
    // NextToken: aws.String("<next_token>"),              
    Limit=aws.Int32(10),
)

resp, err := client.FilterLogEvents(context.TODO(), input)
if err != nil {
    log.Fatalf("Ошибка FilterLogEvents: %v", err)
}

fmt.Printf("Response: %+v\n", resp)
```
Specify:
- <log_group_name> - log group name, e.g. s/lbaas/Bellatrix-lb;
- optional: <timestamp> - end of time range in timestamp format;
- <events_number> - maximum number of log events returned, e.g. 10. The minimum value of events in the response is 1, and the maximum value is 10000. If no limit is specified, the default number of events in the response is 1 MB (up to 10,000 events);
- optional: <next_token> - the token for the next set of returned events that you received in response to a past request.

Run the script. In the response you will get:

empty list, if there are no events in the stream. Example answer:
```
{"events":[]}
```

LIST. Example answer:

{
    "events": [
        {
            "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
            "ingestion": 1742920694862,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687071
        },
        {
            "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
            "ingestion": 1742920697233,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687061
        }
    ]
}

list of events and nextToken if there are more events. You can use the token in the request to get the next page of results. Example response:
```
{
    "events": [...],
    "nextToken": "string"
}
```

For your information

Open the CLI.
To filter events, run the command:
```
aws logs filter-log-events --log-group-name <log_group_name> --log-stream-name <log_stream_name> --filter-pattern <filter>
```
Specify:
- <log_group_name> - log group name, e.g. s/lbaas/Bellatrix-lb;
- <log_stream_name> - event stream name, e.g. http-b964dde5-7080-4169-8f9e-127bd59c89ca;
- <filter> - the value that the events contain, e.g. timeout.