cloudwatch_insights
Run a CloudWatch Logs Insights query to aggregate and analyze log data from one or more log groups, using custom query strings for metrics like top IPs or status code distribution.
Instructions
Run a CloudWatch Logs Insights query over one or more log groups. The general aggregation primitive (top IPs, status mix, URI ranking, time-bucketing) — use it when cloudwatch_top_ips doesn't compute what you need. Provide a query plus log_group or log_groups.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Logs Insights query string, e.g. 'stats count(*) as hits by httpRequest.clientIp | sort hits desc | limit 20'. | |
| log_group | No | A single log group name (or use log_groups). | |
| log_groups | No | List of log group names to query together. | |
| hours_back | No | How many hours back the query window spans. | |
| region | No | AWS region (optional). | |
| limit | No | Max rows Insights returns. | |
| timeout_seconds | No | Max seconds to wait for the query to finish. |