Retrieve logs

For your information

You can retrieve logs of balancers and Managed Database clusters for which logging is enabled. You can also retrieve logs that you have added yourself.

You can retrieve a list of log groups, a list of event streams, and events.

You can retrieve logs:

via the control panel;
using the AWS CLI;
or the SDK client.

You can also export logs to your own storage using the Fluent Bit plugin and the Grafana Alloy agent.

The URL of the Logs service in the required pool can be viewed in the Logs subsection of the URL List instruction.

Retrieve a list of log groups

Control panel
SDK client
AWS CLI

In the control panel, on the top menu, click Products and select Logs.
In the Logs section, select a location.

For your information

The service does not support the logGroupClass, includeLinkedAccounts, accountIdentifiers and logGroupIdentifiers parameters for retrieving a list of log groups. Learn more about log group parameters in the DescribeLogGroups instruction in the official AWS documentation.

Python
Go

Open the script file. If you do not have a script file yet, create a new one.
Add a script to retrieve log groups to the file:
```
response = client.describe_log_groups(
    # logGroupNamePrefix='<log_group_name_prefix>',
    # logGroupNamePattern='<log_group_name_pattern>',
    # nextToken='<next_token>',
    limit=<log_groups_number>,
)

print(response['logGroups'])
print(response.get('nextToken'))
```
Specify:
- optional: <log_group_name_prefix> — a log group prefix, for example s/lbaas/; do not specify the logGroupNamePrefix parameter if you have passed the logGroupNamePattern;
- optional: <log_group_name_pattern> — a log group name pattern for filtering. The parameter is case-sensitive. The response will display log groups whose names match the specified value. For example, if you specify lbaas, the response will show log groups named lbaas and s/lbaas. Do not specify the logGroupNamePattern parameter if you have passed the logGroupNamePrefix;
- optional: <next_token> — a token for the next set of returned groups, which you received in the response to your previous request;
- <log_groups_number> — the maximum number of groups in the response, for example, 10. If no value is specified, 50 groups are returned by default. If no groups are found, you will receive an empty list. Response example:

Run the script. In the response, you will receive:

an empty list if there are no log groups. Response example:
```
{"logGroups":[]}
```

a list of log groups. Response example:

{
    "logGroups": [
        {
            "logGroupName": "s/lbaas/Bellatrix-lb",
            "creationTime": 1742663023757
        },
        {
            "logGroupName": "group-name",
            "creationTime": 1738779717218
        },
        {
            "logGroupName": "s/lbaas/test-lb-for-logs",
            "creationTime": 1743073180613
        }
    ]
}

a list of log groups and nextToken if there are more groups. You can use the token in your request to retrieve the next page of results. Response example:
```
{
    "logGroups": [...],
    "nextToken": 'string'
}
```

Retrieve a list of event streams

Control panel
SDK client
AWS CLI

In the control panel, on the top menu, click Products and select Logs.
In the Logs section, select a location.
Optional: select a log group product.
Open the log group page.

For your information

The service does not support the logGroupIdentifier, descending and orderBy parameters for retrieving a list of event streams. Learn more about event stream parameters in the DescribeLogStreams instruction in the official AWS documentation.

Python
Go

Open the script file. If you do not have a script file yet, create a new one.
Add a script to retrieve event streams to the file:
```
response = client.describe_log_streams(
    logGroupName='<log_group_name>',
    # nextToken='<next_token>',
    limit=<streams_number>,
)

print(response['logGroups'])
print(response.get('nextToken'))
```
Specify:
- <log_group_name> — a log group name, for example, s/lbaas/Bellatrix-lb;
- optional: <next_token> — a token for the next set of returned streams, which you received in the response to your previous request;
- <streams_number> — the maximum number of streams in the response, for example, 10. If no value is specified, 50 streams are returned by default.

Run the script. In the response, you will receive:

an empty list if there are no streams in the log group. Response example:
```
{"logStreamName":[]}
```

a list of streams in the log group. Response example:

{
    "logStreamName": [
        {
            "logStreamName": "pgbouncer.log-2a682d5d-dea9-48bc-8850-0c332c574f4e", 
            "creationTime": 1755619440620
        },
        {
            "logGroupName": "stream-name",
            "creationTime": 1755619440634
        }
    ]
}

a list of streams and nextToken if there are more streams. You can use the token in your request to retrieve the next page of results. Response example:
```
{
    "logStreamName": [...],
    "nextToken": "string"
}
```

Retrieve events

Control panel
SDK client
AWS CLI

In the control panel, on the top menu, click Products and select Logs.
In the Logs section, select a location.
Optional: select a log group product.
Open the log group page.
Select a stream.
Optional: filter the events.

For your information

The service does not support the logGroupIdentifier and unmask parameters for retrieving events. Learn more about event parameters in the GetLogEvents instruction in the official AWS documentation.

Python
Go

Open the script file. If you do not have a script file yet, create a new one.
Add a script to retrieve events to the file:
```
response = client.get_log_events(
    logGroupName='<log_group_name>',
    logStreamName='<stream_name>',
    # nextBackwardToken='<backward_token>',
    # nextForwardToken='<forward_token>',
    limit=<events_number>
)

print(response)
```
Specify:
- <log_group_name> — a log group name, for example, s/lbaas/Bellatrix-lb;
- <log_stream_name> — an event stream name, for example, http-b964dde5-7080-4169-8f9e-127bd59c89ca;
- optional: <backward_token> — a token for the previous set of returned events, which you received in the response to your previous request;
- optional: <forward_token> — a token for the next set of returned events, which you received in the response to your previous request;
- <events_number> — the maximum number of log events in the response. The minimum number of events in the response is 1, the maximum value is 10 000. If no limit is specified, the response displays by default a number of events equal to 1 MB (up to 10 000 events).

Run the script. In the response, you will receive:

an empty list if there are no events in the stream. Response example:
```
{"events":[]}
```

a list of events in the stream. Response example:

{
    "events": [
        {
            "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
            "ingestion": 1742920694862,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687071
        },
        {
            "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
            "ingestion": 1742920697233,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687061
        }
    ]
}

a list of events, nextBackwardToken or nextForwardToken, if there are more events. You can use the token in your request to retrieve the previous or next page of results. Response example:
```
{
    "events": [...],
    "nextBackwardToken": "string",
    "nextForwardToken": "string"
}
```

Filter events

Control panel
SDK client
AWS CLI

In the control panel, on the top menu, click Products and select Logs.
In the Logs section, select a location.
Optional: select a product for which log groups are collected.
Open the log group page.
Select a stream.
Optional: enter the values that the events should contain in the search bar. You can use filter patterns for unstructured logs. Learn more in the Using filter patterns to match terms in unstructured log events instruction in the official AWS documentation.

Examples of values in the search bar and results of searching by filter pattern:
- error — displays events that contain error;
- error timeout — displays events that contain error`` and timeout;
- ?500 ?404 — displays events that contain 500`` or 404;
- error -timeout — displays events that contain error but do not contain timeout;
- "internal server error" — displays events with an exact value match.
Optional: filter logs by time:

7.1. Select a preset range or specify the period for which you need events.

7.2. Select UTC time or Local time for the event display time.
Optional: if logs are collected in JSON format, configure the table display of fields in the events list:

8.1. Click .

8.2. Select the checkboxes for the fields whose values you want to display in a table.

8.3. Click Confirm.

For your information

The service does not support the interleaved, logGroupIdentifier and unmask parameters for filtering events. Learn more about event filtering parameters in the FilterLogEvents instruction in the official AWS documentation.

Python
Go

Open the script file. If you do not have a script file yet, create a new one.
Add a script to filter events to the file:
```
response = client.filter_log_events(
    logGroupName='<log_group_name>',
    # endTime=<timestamp>,
    # nextToken='<next_token>',
    limit=<events_number>
)

print(response['events'])
print(response.get('nextToken'))
```
Specify:
- <log_group_name> — a log group name, for example s/lbaas/Bellatrix-lb;
- optional: <timestamp> — end of the time range in timestamp`` format;
- <events_number> — the maximum number of returned log events, for example 10. The minimum number of events in the response is 1, the maximum value is 10 000. If no limit is specified, the response displays by default a number of events equal to 1 MB (up to 10 000 events);
- optional: <next_token> — a token for the next set of returned events, which you received in the response to your previous request.

Run the script. In the response, you will receive:

an empty list if there are no events in the stream. Response example:
```
{"events":[]}
```

a list of events. Response example:

{
    "events": [
        {
            "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
            "ingestion": 1742920694862,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687071
        },
        {
            "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
            "ingestion": 1742920697233,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687061
        }
    ]
}

a list of events and nextToken if there are more events. You can use the token in your request to retrieve the next page of results. Response example:
```
{
    "events": [...],
    "nextToken": "string"
}
```