> ## Documentation Index
> Fetch the complete documentation index at: https://docs.danubeai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS CloudWatch

> Let agents search logs, run Logs Insights queries, pull recent errors and read metrics and alarms

The CloudWatch connector reads CloudWatch Logs and CloudWatch Metrics in one region. It never writes. Setup, the cross-account role and the IAM policy are on the [AWS page](/connectors/aws#cloudwatch).

## Tools

| Tool                        | What it returns                                                                                                                                                    |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Test Connection**         | The AWS account and identity, and whether it may read log groups and alarms                                                                                        |
| **List Log Groups**         | Log groups with retention in days, stored bytes and creation time, by name prefix                                                                                  |
| **Filter Log Events**       | Events in a time window matching a filter pattern, oldest first, with ISO timestamp, stream and message; `next_token` to continue                                  |
| **Run Logs Insights Query** | Rows of a Logs Insights query plus records and bytes scanned. A query still running at the deadline returns its `query_id`; call again with it to collect the rows |
| **Get Recent Errors**       | The newest error lines in a group, and the matches grouped by message with ids, numbers and timestamps masked, so the dominant failure is on top                   |
| **Get Metric Data**         | One metric series (namespace, metric, dimensions, statistic, period) with min, max, average and latest                                                             |
| **List Alarms**             | Alarms with state, state reason and when it changed; firing alarms first                                                                                           |

Times take ISO 8601 (`2026-09-26T10:00:00Z`) or a relative duration back from now: `15m`, `2h`, `1d`.

## Safety

* No write tools, and the recommended policy grants reads only.
* Filter Log Events and Get Recent Errors page through at most 20 pages per call and stop at the timeout; a cut result says so.
* Logs Insights bills per GB scanned. Keep the window short and filter early in the query.

## Example prompts

* "Pull the last 50 errors from `/aws/lambda/checkout` in the past hour and tell me which one dominates."
* "Run a Logs Insights query over `/app/checkout` counting `card_declined` by merchant for the last 6 hours."
* "Which CloudWatch alarms are firing right now, and since when?"
* "Show p99 `Duration` for the `checkout` function over the last 3 hours in 5 minute buckets."