Get the logs

For your information

You can only retrieve logs for balancers and cloud database clusters for which logging is enabled.

You can:

get a list of log groups;
get a list of event streams;
to receive events.

Logs can be retrieved using:

control panel;
AWS CLI interface, which allows you to use the Amazon CloudWatch API methods, detailed in the (DescribeLogGroups, DescribeLogStreams, GetLogEvents) and FilterLogEvents articles of the AWS documentation. To get started, configure the AWS CLI;
SDK client. To get started Set up the SDK client;
of the Fluent Bit plug-in. To get started , configure Fluent Bit;
Grafana Alloy agent. Set up Grafana Alloy to get started.

The address (URL) can be viewed in the URL list.

Get a list of log groups

For your information

The service does not support the logGroupClass, includeLinkedAccounts, accountIdentifiers, and logGroupIdentifiers parameters to retrieve a list of log groups. For more information about log group parameters, see the DescribeLogGroups article in the official AWS documentation.

Control panel
SDK client
AWS CLI

In the dashboard, on the top menu, click Products and select Logs.
Go to the Logs section.
Select a region and pool.

Python
Go

Open an existing script file or create a new one.
Copy the script into a file:
```
response = client.describe_log_groups(
    # logGroupNamePrefix='<log_group_name_prefix>',
    # logGroupNamePattern='<log_group_name_pattern>',
    # nextToken='<next_token>',
    limit=<log_groups_number>,
)

print(response['logGroups'])
print(response.get('nextToken'))
```
Specify:
- Optional: <log_group_group_name_preffix> — log group prefix, for example s/lbaas/;Do not specify the logGroupNamePrefix parameter if you passed the logGroupNamePattern parameter ;
- optional: <log_group_name_pattern> — log group name pattern for filtering. The parameter is case sensitive. Log groups whose names match the specified value will be displayed in the response. For example, if you specify lbaas, the response will display log groups named lbaas, s/lbaas. Do not specify the logGroupNamePattern parameter if you passed the logGroupNamePrefix parameter;
- optional: <next_token> — token for the next set of returned groups;
- <log_groups_number> — maximum number of groups in the response, e.g. 10. If no value is specified, 50 groups will be returned by default. If no groups are found, you will get an empty list. Example answer:

Run the script. In the response you will get:

empty list if there is no log group. Example answer:
```
{"logGroups":[]}
```

log group list. Example answer:

{
    "logGroups": [
        {
            "logGroupName": "s/lbaas/Bellatrix-lb",
            "creationTime": 1742663023757
        },
        {
            "logGroupName": "group-name",
            "creationTime": 1738779717218
        },
        {
            "logGroupName": "s/lbaas/test-lb-for-logs",
            "creationTime": 1743073180613
        }
    ]
}

list of the log group and nextToken if there are more groups. You can specify a token in the query to get the next page of results. Example response:
```
{
    "logGroups": [...],
    "nextToken": 'string'
}
```

Open an existing script file or create a new one.
Copy the script into a file:
```
  input := &cloudwatchlogs.DescribeLogGroupsInput{
    // LogGroupNamePrefix: aws.String("<log_group_name_prefix>"),
    // LogGroupNamePattern: aws.String("<log_group_name_pattern>"),
    // NextToken: aws.String("<next_token>"),
    Limit: aws.Int32(log_<groups_number>),
  }

  resp, err := client.DescribeLogGroups(context.TODO(), input)
  if err != nil {
    log.Fatalf("Ошибка DescribeLogGroups: %v", err)
  }

  fmt.Printf("Response: %+v\n", resp)
```
Specify:
- Optional: <log_group_group_name_preffix> — log group prefix, for example s/lbaas/;Do not specify the logGroupNamePrefix parameter if you passed the logGroupNamePattern parameter ;
- optional: <log_group_name_pattern> — log group name pattern for filtering. The parameter is case sensitive. Log groups whose names match the specified value will be displayed in the response. For example, if you specify lbaas, the response will display log groups named lbaas, s/lbaas. Do not specify the logGroupNamePattern parameter if you passed the logGroupNamePrefix parameter;
- optional: <next_token> — token for the next set of returned groups;
- <log_groups_number> — maximum number of groups in the response, e.g. 10. If no value is specified, 50 groups will be returned by default.

Run the script. In the response you will get:

empty list if there is no log group. Example answer:
```
{"logGroups":[]}
```

log group list. Example answer:

{
    "logGroups": [
        {
            "logGroupName": "s/lbaas/Bellatrix-lb",
            "creationTime": 1742663023757
        },
        {
            "logGroupName": "group-name",
            "creationTime": 1738779717218
        },
        {
            "logGroupName": "s/lbaas/test-lb-for-logs",
            "creationTime": 1743073180613
        }
    ]
}

list of the log group and nextToken if there are more groups. You can specify a token in the query to get the next page of results. Example response:
```
{
    "logGroups": [...],
    "nextToken": 'string'
}
```

Execute the command:

aws logs describe-log-groups

Get a list of event streams

For your information

The service does not support the logGroupIdentifier, descending, and orderBy parameters for retrieving a list of event streamers. For more information about event stream parameters, see the DescribeLogStreams article in the official AWS documentation.

Control panel
SDK client
AWS CLI

In the dashboard, on the top menu, click Products and select Logs.
Go to the Logs section.
Select a region and pool.
Optional: select the product of the log group.
Open the log group page.

Python
Go

Open an existing script file or create a new one.
Copy the script into a file:
```
response = client.describe_log_streams(
    logGroupName='<log_group_name>',
    # nextToken='<next_token>',
    limit=<streams_number>,
)

print(response['logGroups'])
print(response.get('nextToken'))
```
Specify:
- <log_group_name> — log group name, e.g. s/lbaas/Bellatrix-lb;
- optional: <next_token> — token for the next set of returned streams;
- <streams_number> — maximum number of streams in the response, e.g. 10. If no value is specified, 50 streams will be returned by default.

Run the script. In the response you will get:

empty list if there are no streamers in the log group. Example answer:
```
{"logStreamName":[]}
```

list of streamers in the log group. Example answer:

{
    "logStreamName": [
        {
            "logStreamName": "pgbouncer.log-2a682d5d-dea9-48bc-8850-0c332c574f4e", 
            "creationTime": 1755619440620
        },
        {
            "logGroupName": "stream-name",
            "creationTime": 1755619440634
        }
    ]
}

list of streams and nextToken if there are more streams. You can specify a token in the request to get the next page of results. Example response:
```
{
    "logStreamName": [...],
    "nextToken": "string"
}
```

Open an existing script file or create a new one.

Copy the script into a file:

input := &cloudwatchlogs.DescribeLogStreamsInput{
  LogGroupName: aws.String("<log_group_name>"),
  // NextToken: aws.String("<next_token>"),
  Limit:        aws.Int32(<streams_number>),
}

resp, err := client.DescribeLogStreams(context.TODO(), input)
if err != nil {
log.Fatalf("Ошибка DescribeLogStreams: %v", err)
}

fmt.Printf("Response: %+v\n", resp)

Specify:

<log_group_name> — log group name, e.g. s/lbaas/Bellatrix-lb;
optional: <next_token> — token for the next set of returned streams;
<streams_number> — maximum number of streams in the response, e.g. 10. If no value is specified, 50 streams will be returned by default.

Run the script. In the response you will get:

empty list if there are no streamers in the log group. Example answer:
```
{"logStreamName":[]}
```

list of streamers in the log group. Example answer:

{
    "logStreamName": [
        {
            "logStreamName": "pgbouncer.log-2a682d5d-dea9-48bc-8850-0c332c574f4e", 
            "creationTime": 1755619440620
        },
        {
            "logGroupName": "stream-name",
            "creationTime": 1755619440634
        }
    ]
}

list of streams and nextToken if there are more streams. You can specify a token in the request to get the next page of results. Example response:
```
{
    "logStreamName": [...],
    "nextToken": "string"
}
```

Execute the command:

aws logs describe-log-streams --log-group-name <log_group_name>

Specify <log_group_name> — log group name, for example s/lbaas/Bellatrix-lb.

Get events

For your information

The service does not support the logGroupIdentifier and unmask parameters for receiving events. For more information about event parameters, see the GetLogEvents article in the official AWS documentation.

Control panel
SDK client
AWS CLI

In the Dashboard, on the top menu, click Products and select Logs.
Go to the Logs section.
Select a region and pool.
Optional: select the product of the log group.
Open the log group page.
Select Stream.
Optional: filter the events.

Python
Go

Open an existing script file or create a new one.
Copy the script into a file:
```
response = client.get_log_events(
    logGroupName='<log_group_name>',
    logStreamName='<stream_name>',
    # nextBackwardToken='<back_token>',
    # nextForwardToken='<next_token>',
    limit=<events_number>
)

print(response)
```
Specify:
- <log_group_name> — log group name, e.g. s/lbaas/Bellatrix-lb;
- <log_stream_name> — event stream name, e.g. http-b964dde5-7080-4169-8f9e-127bd59c89ca;
- optional: <back_token> — token for the previous set of returned events;
- optional: <next_token> — token for the next set of returned events;
- <events_number> — maximum number of log events in the response. The minimum value of events in the response is 1, the maximum value is 10000. If no limit is specified, the default number of events in the response is 1 MB (up to 10,000 events).

Run the script. In the response you will get:

empty list, if there are no events in the stream. Example answer:
```
{"events":[]}
```

list of stream events. Example answer:

{
    "events": [
        {
            "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
            "ingestion": 1742920694862,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687071
        },
        {
            "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
            "ingestion": 1742920697233,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687061
        }
    ]
}

list of events, nextBackwardToken or nextForwardToken if there are more events. You can specify a token in the request to retrieve the previous or next page of results. Example response:
```
{
    "events": [...],
    "nextBackwardToken": "string",
    "nextForwardToken": "string"
}
```

Open an existing script file or create a new one.
Copy the script into a file:
```
input := &cloudwatchlogs.GetLogEventsInput{
    LogGroupName: aws.String("<log_group_name>"),
    LogStreamName: aws.String("<log_stream_name>"),
    // NextBackwardToken: aws.String("<back_token>"),
    // NextForwardToken: aws.String("<next_token>"),
    Limit: aws.Int32(<events_number>),
}

resp, err := client.GetLogEvents(context.TODO(), input)
if err != nil {
    log.Fatalf("Ошибка GetLogEvents: %v", err)
}

fmt.Printf("Response: %+v\n", resp)
```
Specify:
- <log_group_name> — log group name, e.g. s/lbaas/Bellatrix-lb;
- <log_stream_name> — event stream name, e.g. http-b964dde5-7080-4169-8f9e-127bd59c89ca;
- optional: <back_token> — token for the previous set of returned events;
- optional: <next_token> — token for the next set of returned events;
- <events_number> — maximum number of log events returned, e.g. 10. The minimum value of events in the response is 1, and the maximum value is 10000. If no limit is specified, the default number of events in the response is 1 MB (up to 10,000 events).

Run the script. In the response you will get:

empty list, if there are no events in the stream. Example answer:
```
{"events":[]}
```

list of stream events. Example answer:

{
    "events": [
        {
            "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
            "ingestion": 1742920694862,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687071
        },
        {
            "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
            "ingestion": 1742920697233,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687061
        }
    ]
}

list of events, nextBackwardToken or nextForwardToken if there are more events. You can specify a token in the request to retrieve the previous or next page of results. Example response:
```
{
    "events": [...],
    "nextBackwardToken": "string",
    "nextForwardToken": "string"
}
```

Execute the command:

aws logs get-log-events --log-group-name  <log_group_name> --log-stream-name <log_stream_name>

Specify:

<log_group_name> — log group name, e.g. s/lbaas/Bellatrix-lb;
<log_stream_name> — event stream name, e.g. http-b964dde5-7080-4169-8f9e-127bd59c89ca.

Filter events

For your information

The service does not support the interleaved, logGroupIdentifier, and unmask parameters for event filtering. For more information about event filtering parameters, see the FilterLogEvents article in the AWS official documentation.

Control panel
SDK client
AWS CLI

In the dashboard, on the top menu, click Products and select Logs.
Go to the Logs section.
Select a region and pool.
Optional: select the product of the log group.
Open the log group page.
Select Stream.
In the search box, enter the value that the events contain. You can use a filter pattern for unstructured log events. For more information, see Using filter patterns to match terms in unstructured log events in AWS documentation.

Examples of values in the search box and search results from the filter pattern:
- errors — events that contain error;
- error timeout — events that contain error and timeout;
- ?500 ?404 — will display events that contain 500 or 404;
- error -timeout — events that contain error but do not contain timeout;
- "internal server error" — events with an exact match of the value will be output.
Optional: select UTC Time or Local Time for the displayed event time.
Specify a time period to filter events.

Python
Go

Open an existing script file or create a new one.
Copy the script into a file:
```
response = client.filter_log_events(
    logGroupName='<log_group_name>',
    # endTime=<timestamp>,
    # nextToken='<next_token>',
    limit=<events_number>
)

print(response['events'])
print(response.get('nextToken'))
```
Specify:
- <log_group_name> — log group name, e.g. s/lbaas/Bellatrix-lb;
- optional: <timestamp> — end of time range in timestamp format;
- <events_number> — maximum number of log events returned, e.g. 10. The minimum value of events in the response is 1, and the maximum value is 10000. If no limit is specified, the default number of events in the response is 1 MB (up to 10,000 events);
- optional: <next_token> — token for the next set of returned events.

Run the script. In the response you will get:

empty list, if there are no events in the stream. Example answer:
```
{"events":[]}
```

LIST. Example answer:

{
    "events": [
        {
            "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
            "ingestion": 1742920694862,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687071
        },
        {
            "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
            "ingestion": 1742920697233,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687061
        }
    ]
}

list of events and nextToken if there are more events. You can specify a token in the request to get the next page of results. Example response:
```
{
    "events": [...],
    "nextToken": "string"
}
```

Open an existing script file or create a new one.
Copy the script into a file:
```
input := &cloudwatchlogs.GetLogEventsInput{
    LogGroupName=aws.String("stging"),
    // EndTime=aws.Int64(<timestamp>),
    // NextToken: aws.String("<next_token>"),              
    Limit=aws.Int32(10),
)

resp, err := client.FilterLogEvents(context.TODO(), input)
if err != nil {
    log.Fatalf("Ошибка FilterLogEvents: %v", err)
}

fmt.Printf("Response: %+v\n", resp)
```
Specify:
- <log_group_name> — log group name, e.g. s/lbaas/Bellatrix-lb;
- optional: <timestamp> — end of time range in timestamp format;
- <events_number> — maximum number of log events returned, e.g. 10. The minimum value of events in the response is 1, and the maximum value is 10000. If no limit is specified, the default number of events in the response is 1 MB (up to 10,000 events);
- optional: <next_token> — token for the next set of returned events.

Run the script. In the response you will get:

empty list, if there are no events in the stream. Example answer:
```
{"events":[]}
```

LIST. Example answer:

{
    "events": [
        {
            "id": "6b050a98-8810-4832-b0fe-aee56e34b682",
            "ingestion": 1742920694862,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"354\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"991\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"4\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687071
        },
        {
            "id": "687feab8-6eb9-4ef1-95ed-92259b6bce4a",
            "ingestion": 1742920697233,
            "message": "{\"loadbalancer_id\":\"b964dde5-7080-4169-8f9e-127bd59c89ca\",\"client\":\"10.10.10.10:61076\",\"server_queue\":\"0\",\"backend\":\"0c7498bf-e053-43a8-ba19-4550c9d9904d:3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"bytes_out\":\"413\",\"backend_connections\":\"0\",\"destination\":\"192.168.0.18:80\",\"bytest_in\":\"1039\",\"termination_state\":\"--\",\"server\":\"ac64ca54-952f-4881-8a54-6ff77baa1e91\",\"frontend_connections\":\"1\",\"backend_queue\":\"0\",\"elapsed\":\"9\",\"frontend\":\"3ae8b472-d305-4ef0-8093-d43c87bc3646\",\"server_connections\":\"0\"}",
            "timestamp": 1742920687061
        }
    ]
}

list of events and nextToken if there are more events. You can specify a token in the request to get the next page of results. Example response:
```
{
    "events": [...],
    "nextToken": "string"
}
```

Execute the command:

aws logs filter-log-events --log-group-name <log_group_name> --log-stream-name <log_stream_name> --filter-pattern <filter>

Specify:

<log_group_name> — log group name, e.g. s/lbaas/Bellatrix-lb;
<log_stream_name> — event stream name, e.g. http-b964dde5-7080-4169-8f9e-127bd59c89ca;
<filter> — the value that the events contain, e.g. timeout.