---
title: "Retrieve logs"
sidebar_label: "Retrieve logs"
description: "How to retrieve a list of log groups, event streams, and events"
sidebar_position: 1
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from 'docs-kit/components'
import SettingIcon from 'docs-kit/icons/settings'

# Retrieve logs

:::info

You can retrieve logs of balancers and Managed Database clusters for which logging is enabled. You can also retrieve logs that you [have added](/logs/manage/add-logs.mdx) yourself.

:::

You can [retrieve a list of log groups](#get-list-of-log-groups), [a list of event streams](#get-list-of-event-streams), and [events](#get-events).

You can retrieve logs:

* via the [control panel](https://my.selectel.ru/vpc/default/logs/);
* using the [AWS CLI](/logs/tools/aws-cli.mdx);
* or the [SDK client](/logs/tools/sdk-client.mdx).

You can also export logs to your own storage using the [Fluent Bit](/logs/tools/fluent-bit.mdx) plugin and the [Grafana Alloy agent](/logs/tools/grafana-alloy.mdx).

The URL for the Logs service in the required pool can be found in the [List of URLs](/api/urls/) (URL) guide.

## Retrieve a list of log groups \{#get-list-of-log-groups}

<Tabs queryString="get-list-of-log-groups">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/vpc/default/logs/), on the top menu, click **Products** and select **Logs**.

    2. In the **Logs** section, select a [location](/infrastructure/locations.mdx).
  </TabItem>

  <TabItem value="sdk-client">
    <TabItemLabel>
      SDK client
    </TabItemLabel>

    :::info

    The service does not support the `logGroupClass`, `includeLinkedAccounts`, `accountIdentifiers` and `logGroupIdentifiers` parameters for retrieving a list of log groups. Learn more about log group parameters in the [DescribeLogGroups](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html) guide in the official AWS documentation.

    :::

    <Tabs>
      <TabItem value="python">
        <TabItemLabel>
          Python
        </TabItemLabel>

        1. Open the script file. If you do not have a script file yet, create a new one.

        2. Add a script to retrieve log groups to the file:

           ```python
           response = client.describe_log_groups(
               # logGroupNamePrefix='<log_group_name_prefix>',
               # logGroupNamePattern='<log_group_name_pattern>',
               # nextToken='<next_token>',
               limit=<log_groups_number>,
           )

           print(response['logGroups'])
           print(response.get('nextToken'))
           ```

           Specify:

           * optional: `<log_group_name_prefix>` — a log group prefix, for example `s/lbaas/`; Do not specify the `logGroupNamePrefix` parameter if you have passed the `logGroupNamePattern`;

           * optional: `<log_group_name_pattern>` — a log group name pattern for filtering. The parameter is case-sensitive. The response will display log groups whose names match the specified value. For example, if you specify `lbaas`, the response will display log groups with names `lbaas`, `s/lbaas`. Do not specify the `logGroupNamePattern` parameter if you have passed the `logGroupNamePrefix`;

           * optional: `<next_token>` — a token for the next set of returned groups that you received in the response to the previous request;

           * `<log_groups_number>` — the maximum number of groups in the response, for example `10`. If the value is not specified, 50 groups will be returned by default. If no groups are found, you will receive an empty list. Response example:

        3. Run the script. In the response, you will receive:

           * an empty list if there are no log groups. Response example:

             ```json
             {"logGroups":[]}
             ```

           * a list of log groups. Response example:

             ```json
             {
                 "logGroups": [
                     {
                         "logGroupName": "s/lbaas/Bellatrix-lb",
                         "creationTime": 1742663023757
                     },
                     {
                         "logGroupName": "group-name",
                         "creationTime": 1738779717218
                     },
                     {
                         "logGroupName": "s/lbaas/test-lb-for-logs",
                         "creationTime": 1743073180613
                     }
                 ]
             }
             ```

           * a list of log groups and `nextToken` if there are more groups. You can use the token in a request to get the next page of results. Response example:

             ```json
             {
                 "logGroups": [...],
                 "nextToken": 'string'
             }
             ```
      </TabItem>

      <TabItem value="go">
        <TabItemLabel>
          Go
        </TabItemLabel>

        1. Open the script file. If you do not have a script file yet, create a new one.

        2. Add a script to retrieve log groups to the file:

           ```go
             input := &cloudwatchlogs.DescribeLogGroupsInput{
               // LogGroupNamePrefix: aws.String("<log_group_name_prefix>"),
               // LogGroupNamePattern: aws.String("<log_group_name_pattern>"),
               // NextToken: aws.String("<next_token>"),
               Limit: aws.Int32(log_<groups_number>),
             }

             resp, err := client.DescribeLogGroups(context.TODO(), input)
             if err != nil {
               log.Fatalf("DescribeLogGroups error: %v", err)
             }

             fmt.Printf("Response: %+v\n", resp)

           ```

           Specify:

           * optional: `<log_group_name_preffix>` — a log group prefix, for example `s/lbaas/`; Do not specify the `logGroupNamePrefix` parameter if you have passed the `logGroupNamePattern`;

           * optional: `<log_group_name_pattern>` — a log group name pattern for filtering. The parameter is case-sensitive. The response will display log groups whose names match the specified value. For example, if you specify `lbaas`, the response will display log groups with names `lbaas`, `s/lbaas`. Do not specify the `logGroupNamePattern` parameter if you have passed the `logGroupNamePrefix`;

           * optional: `<next_token>` — a token for the next set of returned groups that you received in the response to the previous request;

           * `<log_groups_number>` — the maximum number of groups in the response, for example `10`. If the value is not specified, 50 groups will be returned by default.

        3. Run the script. In the response, you will receive:

           * an empty list if there are no log groups. Response example:

             ```json
             {"logGroups":[]}
             ```

           * a list of log groups. Response example:

             ```json
             {
                 "logGroups": [
                     {
                         "logGroupName": "s/lbaas/Bellatrix-lb",
                         "creationTime": 1742663023757
                     },
                     {
                         "logGroupName": "group-name",
                         "creationTime": 1738779717218
                     },
                     {
                         "logGroupName": "s/lbaas/test-lb-for-logs",
                         "creationTime": 1743073180613
                     }
                 ]
             }
             ```

           * a list of log groups and `nextToken` if there are more groups. You can use the token in a request to get the next page of results. Response example:

             ```json
             {
                 "logGroups": [...],
                 "nextToken": 'string'
             }
             ```
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    :::info

    The service does not support the `logGroupClass`, `includeLinkedAccounts`, `accountIdentifiers` and `logGroupIdentifiers` parameters for retrieving a list of log groups. Learn more about log group parameters in the [DescribeLogGroups](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html) guide in the official AWS documentation.

    :::

    1. Open the CLI.

    2. To retrieve log groups, output information about log groups:

       ```bash
       aws logs describe-log-groups
       ```
  </TabItem>
</Tabs>

## Retrieve a list of event streams \{#get-list-of-event-streams}

<Tabs queryString="get-list-of-event-streams">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/vpc/default/logs/), in the top menu, click **Products** and select **Logs**.

    2. In the **Logs** section, select a [location](/infrastructure/locations.mdx).

    3. Optional: select a log group product.

    4. Open the log group page.
  </TabItem>

  <TabItem value="sdk-client">
    <TabItemLabel>
      SDK client
    </TabItemLabel>

    :::info

    The service does not support the `logGroupIdentifier`, `descending` and `orderBy` parameters for retrieving a list of event streams. Learn more about event stream parameters in the [DescribeLogStreams](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html) guide in the official AWS documentation.

    :::

    <Tabs>
      <TabItem value="python">
        <TabItemLabel>
          Python
        </TabItemLabel>

        1. Open the script file. If you do not have a script file yet, create a new one.

        2. Add a script to retrieve event streams to the file:

           ```python
           response = client.describe_log_streams(
               logGroupName='<log_group_name>',
               # nextToken='<next_token>',
               limit=<streams_number>,
           )

           print(response['logGroups'])
           print(response.get('nextToken'))
           ```

           Specify:

           * `<log_group_name>` — the name of the log group, for example `s/lbaas/Bellatrix-lb`;

           * optional: `<next_token>` — a token for the next set of returned streams that you received in the response to the previous request;

           * `<streams_number>` — the maximum number of streams in the response, for example `10`. If the value is not specified, 50 streams will be returned by default.

        3. Run the script. In the response, you will receive:

           * an empty list if there are no streams in the log group. Response example:

             ```json
             {"logStreamName":[]}
             ```

           * a list of streams in the log group. Response example:

             ```json
             {
                 "logStreamName": [
                     {
                         "logStreamName": "pgbouncer.log-2a682d5d-dea9-48bc-8850-0c332c574f4e", 
                         "creationTime": 1755619440620
                     },
                     {
                         "logGroupName": "stream-name",
                         "creationTime": 1755619440634
                     }
                 ]
             }
             ```

           * a list of streams and `nextToken` if there are more streams. You can use the token in a request to get the next page of results. Response example:

             ```json
             {
                 "logStreamName": [...],
                 "nextToken": "string"
             }
             ```
      </TabItem>

      <TabItem value="go">
        <TabItemLabel>
          Go
        </TabItemLabel>

        1. Open the script file. If you do not have a script file yet, create a new one.

        2. Add a script to retrieve event streams to the file:

           ```go
           input := &cloudwatchlogs.DescribeLogStreamsInput{
             LogGroupName: aws.String("<log_group_name>"),
             // NextToken: aws.String("<next_token>"),
             Limit:        aws.Int32(<streams_number>),
           }

           resp, err := client.DescribeLogStreams(context.TODO(), input)
           if err != nil {
           log.Fatalf("DescribeLogStreams error: %v", err)
           }

           fmt.Printf("Response: %+v\n", resp)
           ```

           Specify:

           * `<log_group_name>` — the name of the log group, for example `s/lbaas/Bellatrix-lb`;

           * optional: `<next_token>` — a token for the next set of returned streams that you received in the response to the previous request;

           * `<streams_number>` — the maximum number of streams in the response, for example `10`. If the value is not specified, 50 streams will be returned by default.

        3. Run the script. In the response, you will receive:

           * an empty list if there are no streams in the log group. Response example:

             ```json
             {"logStreamName":[]}
             ```

           * a list of streams in the log group. Response example:

             ```json
             {
                 "logStreamName": [
                     {
                         "logStreamName": "pgbouncer.log-2a682d5d-dea9-48bc-8850-0c332c574f4e", 
                         "creationTime": 1755619440620
                     },
                     {
                         "logGroupName": "stream-name",
                         "creationTime": 1755619440634
                     }
                 ]
             }
             ```

           * a list of streams and `nextToken` if there are more streams. You can use the token in a request to get the next page of results. Response example:

             ```json
             {
                 "logStreamName": [...],
                 "nextToken": "string"
             }
             ```
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    :::info

    The service does not support the `logGroupIdentifier`, `descending` and `orderBy` parameters for retrieving a list of event streams. Learn more about event stream parameters in the [DescribeLogStreams](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html) guide in the official AWS documentation.

    :::

    1. Open the CLI.

    2. To retrieve event streams, execute the command:

       ```
       aws logs describe-log-streams --log-group-name <log_group_name>
       ```

       Specify `<log_group_name>` — the name of the log group, for example `s/lbaas/Bellatrix-lb`.
  </TabItem>
</Tabs>

## Retrieve events \{#get-events}

<Tabs queryString="get-events">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/vpc/default/logs/), in the top menu, click **Products** and select **Logs**.

    2. In the **Logs** section, select a [location](/infrastructure/locations.mdx).

    3. Optional: select a log group product.

    4. Open the log group page.

    5. Select a stream.

    6. Optional: [filter events](#filter-log-events).
  </TabItem>

  <TabItem value="sdk-client">
    <TabItemLabel>
      SDK client
    </TabItemLabel>

    :::info

    The service does not support the `logGroupIdentifier` and `unmask` parameters for retrieving events. Learn more about event parameters in the [GetLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html) guide in the official AWS documentation.

    :::

    <Tabs>
      <TabItem value="python">
        <TabItemLabel>
          Python
        </TabItemLabel>

        1. Open the script file. If you do not have a script file yet, create a new one.

        2. Add a script to retrieve events to the file:

           ```python
           response = client.get_log_events(
               logGroupName='<log_group_name>',
               logStreamName='<stream_name>',
               # nextBackwardToken='<backward_token>',
               # nextForwardToken='<forward_token>',
               limit=<events_number>
           )

           print(response)
           ```

           Specify:

           * `<log_group_name>` — the name of the log group, for example `s/lbaas/Bellatrix-lb`;

           * `<log_stream_name>` — the name of the event stream, for example `http-b964dde5-7080-4169-8f9e-127bd59c89ca`;

           * optional: `<backward_token>` — a token for the previous set of returned events that you received in the response to the previous request;

           * optional: `<forward_token>` — a token for the next set of returned events that you received in the response to the previous request;

           * `<events_number>` — the maximum number of log events in the response. The minimum number of events in the response is 1, and the maximum is 10,000. If the limit is not specified, the response defaults to displaying a number of events totaling 1 MB (up to 10,000 events).

        3. Run the script. In the response, you will receive:

           * an empty list if there are no events in the stream. Response example:

             ```json
             {"events":[]}
             ```

           * a list of events in the stream. Response example:

             ```json
             {
                 "events": [
                     {
                         "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
                         "ingestion": 1742920694862,
                         "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
                         "timestamp": 1742920687071
                     },
                     {
                         "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
                         "ingestion": 1742920697233,
                         "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
                         "timestamp": 1742920687061
                     }
                 ]
             }
             ```

           * a list of events and `nextBackwardToken` or `nextForwardToken` if there are more events. You can use the token in a request to get the previous or next page of results. Response example:

             ```json
             {
                 "events": [...],
                 "nextBackwardToken": "string",
                 "nextForwardToken": "string"
             }
             ```
      </TabItem>

      <TabItem value="go">
        <TabItemLabel>
          Go
        </TabItemLabel>

        1. Open the script file. If you do not have a script file yet, create a new one.

        2. Add a script to retrieve events to the file:

           ```go
           input := &cloudwatchlogs.GetLogEventsInput{
               LogGroupName: aws.String("<log_group_name>"),
               LogStreamName: aws.String("<log_stream_name>"),
               // NextBackwardToken: aws.String("<backward_token>"),
               // NextForwardToken: aws.String("<forward_token>"),
               Limit: aws.Int32(<events_number>),
           }

           resp, err := client.GetLogEvents(context.TODO(), input)
           if err != nil {
               log.Fatalf("GetLogEvents error: %v", err)
           }

           fmt.Printf("Response: %+v\n", resp)
           ```

           Specify:

           * `<log_group_name>` — the name of the log group, for example `s/lbaas/Bellatrix-lb`;

           * `<log_stream_name>` — the name of the event stream, for example `http-b964dde5-7080-4169-8f9e-127bd59c89ca`;

           * optional: `<backward_token>` — a token for the previous set of returned events that you received in the response to the previous request;

           * optional: `<forward_token>` — a token for the next set of returned events that you received in the response to the previous request;

           * `<events_number>` — the maximum number of log events to return, for example `10`. The minimum number of events in the response is 1, and the maximum is 10,000. If the limit is not specified, the response defaults to displaying a number of events totaling 1 MB (up to 10,000 events).

        3. Run the script. In the response, you will receive:

           * an empty list if there are no events in the stream. Response example:

             ```json
             {"events":[]}
             ```

           * a list of events in the stream. Response example:

             ```json
             {
                 "events": [
                     {
                         "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
                         "ingestion": 1742920694862,
                         "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
                         "timestamp": 1742920687071
                     },
                     {
                         "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
                         "ingestion": 1742920697233,
                         "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
                         "timestamp": 1742920687061
                     }
                 ]
             }
             ```

           * a list of events and `nextBackwardToken` or `nextForwardToken` if there are more events. You can use the token in a request to get the previous or next page of results. Response example:

             ```json
             {
                 "events": [...],
                 "nextBackwardToken": "string",
                 "nextForwardToken": "string"
             }
             ```
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    :::info

    The service does not support the `logGroupIdentifier` and `unmask` parameters for retrieving events. Learn more about event parameters in the [GetLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html) guide in the official AWS documentation.

    :::

    1. Open the CLI.

    2. To retrieve events, execute the command:

       ```
       aws logs get-log-events --log-group-name  <log_group_name> --log-stream-name <log_stream_name>
       ```

       Specify:

       * `<log_group_name>` — the name of the log group, for example `s/lbaas/Bellatrix-lb`;
       * `<log_stream_name>` — the name of the event stream, for example `http-b964dde5-7080-4169-8f9e-127bd59c89ca`.
  </TabItem>
</Tabs>

### Filter events \{#filter-log-events}

<Tabs queryString="filter-events">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. In the [control panel](https://my.selectel.ru/vpc/default/logs/), in the top menu, click **Products** and select **Logs**.

    2. In the **Logs** section, select a [location](/infrastructure/locations.mdx).

    3. Optional: select a product for which log groups are collected.

    4. Open the log group page.

    5. Select a stream.

    6. Optional: in the search bar, enter the values that the events should contain. You can use a filter pattern for unstructured logs. Read more in the [Using filter patterns to match terms in unstructured log events](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/matching-terms-unstructured-log-events.html) guide in the official AWS documentation.

       Examples of values in the search bar and results of searching by filter pattern:

       * `error` — events containing `error` will be displayed;
       * `error timeout` — events containing both `error` and `timeout` will be displayed;
       * `?500 ?404` — events containing either `500` or `404` will be displayed;
       * `error -timeout` — events containing `error` but not containing `timeout` will be displayed;
       * `"internal server error"` — events with an exact value match will be displayed.

    7. Optional: filter logs by time:

       7.1. Select a preset range or specify the period for which you need events.

       7.2. Select **UTC time** or **Local time** for the displayed event time.

    8. Optional: if logs are collected in JSON format, configure the table display of fields in the events list:

       8.1. Click <SettingIcon />.

       8.2. Select the checkboxes for the fields whose values you want to display in a table.

       8.3. Click **Confirm**.
  </TabItem>

  <TabItem value="sdk-client">
    <TabItemLabel>
      SDK client
    </TabItemLabel>

    :::info

    The service does not support the `interleaved`, `logGroupIdentifier` and `unmask` parameters for filtering events. Learn more about event filtering parameters in the [FilterLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html) guide in the official AWS documentation.

    :::

    <Tabs>
      <TabItem value="python">
        <TabItemLabel>
          Python
        </TabItemLabel>

        1. Open the script file. If you do not have a script file yet, create a new one.

        2. Add a script to filter events to the file:

           ```python
           response = client.filter_log_events(
               logGroupName='<log_group_name>',
               # endTime=<timestamp>,
               # nextToken='<next_token>',
               limit=<events_number>
           )

           print(response['events'])
           print(response.get('nextToken'))
           ```

           Specify:

           * `<log_group_name>` — the name of the log group, for example `s/lbaas/Bellatrix-lb`;

           * optional: `<timestamp>` — the end of the time range in `timestamp` format;

           * `<events_number>` — the maximum number of log events to return, for example `10`. The minimum number of events in the response is 1, and the maximum is 10,000. If the limit is not specified, the response defaults to displaying a number of events totaling 1 MB (up to 10,000 events);

           * optional: `<next_token>` — a token for the next set of returned events that you received in the response to the previous request.

        3. Run the script. In the response, you will receive:

           * an empty list if there are no events in the stream. Response example:

             ```json
             {"events":[]}
             ```

           * a list of events. Response example:

             ```json
             {
                 "events": [
                     {
                         "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
                         "ingestion": 1742920694862,
                         "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
                         "timestamp": 1742920687071
                     },
                     {
                         "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
                         "ingestion": 1742920697233,
                         "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
                         "timestamp": 1742920687061
                     }
                 ]
             }
             ```

           * a list of events and `nextToken` if there are more events. You can use the token in a request to get the next page of results. Response example:

             ```json
             {
                 "events": [...],
                 "nextToken": "string"
             }
             ```
      </TabItem>

      <TabItem value="go">
        <TabItemLabel>
          Go
        </TabItemLabel>

        1. Open the script file. If you do not have a script file yet, create a new one.

        2. Add a script to filter events to the file:

           ```go
           input := &cloudwatchlogs.GetLogEventsInput{
               LogGroupName=aws.String("stging"),
               // EndTime=aws.Int64(<timestamp>),
               // NextToken: aws.String("<next_token>"),              
               Limit=aws.Int32(10),
           )

           resp, err := client.FilterLogEvents(context.TODO(), input)
           if err != nil {
               log.Fatalf("FilterLogEvents error: %v", err)
           }

           fmt.Printf("Response: %+v\n", resp)
           ```

           Specify:

           * `<log_group_name>` — the name of the log group, for example `s/lbaas/Bellatrix-lb`;

           * optional: `<timestamp>` — the end of the time range in `timestamp` format;

           * `<events_number>` — the maximum number of log events to return, for example `10`. The minimum number of events in the response is 1, and the maximum is 10,000. If the limit is not specified, the response defaults to displaying a number of events totaling 1 MB (up to 10,000 events);

           * optional: `<next_token>` — a token for the next set of returned events that you received in the response to the previous request.

        3. Run the script. In the response, you will receive:

           * an empty list if there are no events in the stream. Response example:

             ```json
             {"events":[]}
             ```

           * a list of events. Response example:

             ```json
             {
                 "events": [
                     {
                         "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
                         "ingestion": 1742920694862,
                         "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
                         "timestamp": 1742920687071
                     },
                     {
                         "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
                         "ingestion": 1742920697233,
                         "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
                         "timestamp": 1742920687061
                     }
                 ]
             }
             ```

           * a list of events and `nextToken` if there are more events. You can use the token in a request to get the next page of results. Response example:

             ```json
             {
                 "events": [...],
                 "nextToken": "string"
             }
             ```
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="aws-cli">
    <TabItemLabel>
      AWS CLI
    </TabItemLabel>

    :::info

    The service does not support the `interleaved`, `logGroupIdentifier` and `unmask` parameters for filtering events. Learn more about event filtering parameters in the [FilterLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html) guide in the official AWS documentation.

    :::

    1. Open the CLI.

    2. To filter events, execute the command:

       ```
       aws logs filter-log-events --log-group-name <log_group_name> --log-stream-name <log_stream_name> --filter-pattern <filter>
       ```

       Specify:

       * `<log_group_name>` — the name of the log group, for example `s/lbaas/Bellatrix-lb`;
       * `<log_stream_name>` — the name of the event stream, for example `http-b964dde5-7080-4169-8f9e-127bd59c89ca`;
       * `<filter>` — a value that the events should contain, for example `timeout`.
  </TabItem>
</Tabs>

<Formbricks />