search_logs
Search CloudWatch logs with filter patterns and time-based queries to find specific log events. Supports relative times and stream filtering.
Instructions
Search CloudWatch logs with filter patterns and time-based queries. Supports relative times (30m, 1h, 2d) and CloudWatch filter patterns.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of log events to return (default: 100) | |
| endTime | No | End time - relative or ISO 8601 or Unix timestamp (default: now) | |
| logGroup | No | Log group name. Uses CLOUDWATCH_LOG_GROUP env var if not provided | |
| startTime | Yes | Start time - relative (30m, 1h, 2d, 1w) or ISO 8601 or Unix timestamp | |
| logStreams | No | Specific log stream names to search. If not provided, searches all streams | |
| filterPattern | No | CloudWatch filter pattern (e.g., "ERROR", "?ERROR ?WARN", "{ $.level = "error" }") | |
| logStreamPrefix | No | Filter streams by prefix (e.g., "sprive-backend-2026-02-20") |