cloudwatch_insights
Run custom CloudWatch Logs Insights queries across multiple log groups to analyze and aggregate log data, such as top IPs, status codes, or URI rankings.
Instructions
Run a CloudWatch Logs Insights query over one or more log groups. The general aggregation primitive (top IPs, status mix, URI ranking, time-bucketing) — use it when cloudwatch_top_ips doesn't compute what you need. Provide a query plus log_group or log_groups.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max rows Insights returns. | |
| query | Yes | Logs Insights query string, e.g. 'stats count(*) as hits by httpRequest.clientIp | sort hits desc | limit 20'. | |
| region | No | AWS region (optional). | |
| log_group | No | A single log group name (or use log_groups). | |
| hours_back | No | How many hours back the query window spans. | |
| log_groups | No | List of log group names to query together. | |
| timeout_seconds | No | Max seconds to wait for the query to finish. |