# Amazon CloudWatch

> Publish and read CloudWatch metrics, manage alarms and dashboards, and write, search and query CloudWatch Logs.

App · Monitoring · 20 actions. Web page: https://docs.lodol.com/docs/integrations/amazon-cloudwatch

## Actions

### Create log group

Create a CloudWatch Logs log group. Events are kept forever unless a retention period is set in the console.

**Inputs**

- Log group name (`log_group_name`, text, required): Up to 512 letters, digits and '_', '-', '/', '.', '#', for example /myapp/production. It must not start with 'aws/'.
- Log class (`log_group_class`, text): Standard, or Infrequent Access (cheaper ingestion, fewer features). Cannot be changed later. Default Standard. One of: `STANDARD`, `INFREQUENT_ACCESS` (Infrequent Access (cheaper)).
- Tags (`tags`, object): Tags as key: value pairs.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "created": true,
    "log_group_class": "STANDARD",
    "log_group_name": "/myapp/production",
    "tags": {}
  }
}
```

### Create log stream

Create a log stream in a log group, to write events to.

**Inputs**

- Log group (`log_group_name`, text, required): The log group's name, for example /aws/lambda/my-function, or its ARN. Use List log groups to find one.
- Log stream name (`log_stream_name`, text, required): The new stream's name, up to 512 characters. No ':' or '*'.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "created": true,
    "log_group_name": "/myapp/production",
    "log_stream_name": "web-1"
  }
}
```

### Create or update alarm

Create an alarm that watches one metric against a threshold. If an alarm with this name exists it is replaced entirely (tags are kept). A new alarm starts in INSUFFICIENT_DATA.

**Inputs**

- Alarm name (`alarm_name`, text, required): The alarm's exact name (case-sensitive).
- Namespace (`namespace`, text, required): The metric's namespace, for example AWS/EC2 or your own 'MyApp'.
- Metric name (`metric_name`, text, required): The metric's name, for example CPUUtilization.
- Dimensions (`dimensions`, object): The metric's dimensions as name: value pairs, exactly as published (for example InstanceId: i-0123456789abcdef0).
- Condition (`comparison_operator`, text, required): How the metric is compared with the threshold. One of: `GreaterThanOrEqualToThreshold` (>= threshold), `GreaterThanThreshold` (> threshold), `LessThanThreshold` (< threshold), `LessThanOrEqualToThreshold` (<= threshold).
- Threshold (`threshold`, number, required): The value to compare against.
- Statistic (`statistic`, text): How each period's values are combined. Default Average. One of: `SampleCount`, `Average`, `Sum`, `Minimum`, `Maximum`.
- Percentile (`extended_statistic`, text): A percentile instead of a statistic, for example p99. Leave Statistic empty when you use this.
- Period (seconds) (`period`, number): Seconds per evaluated period: 60 or a multiple of it (10, 20 and 30 make a charged high-resolution alarm). Default 300. From 10 to 86400.
- Evaluation periods (`evaluation_periods`, number): How many recent periods are evaluated. Default 1. From 1 to 10080.
- Datapoints to alarm (`datapoints_to_alarm`, number): How many of those periods must breach to alarm (an 'M out of N' alarm). Default all of them. From 1 to 10080.
- Missing data (`treat_missing_data`, text): How periods with no data count. One of: `breaching` (Treat as breaching), `notBreaching` (Treat as not breaching), `ignore` (Ignore (keep the current state)), `missing` (Missing (the default)).
- Unit (`unit`, text): The unit of the values. Leave empty for none. One of: `Seconds`, `Microseconds`, `Milliseconds`, `Bytes`, `Kilobytes`, `Megabytes`, `Gigabytes`, `Terabytes`, `Bits`, `Kilobits`, and 17 more.
- Description (`alarm_description`, text): A description, up to 1024 characters.
- Alarm actions (`alarm_actions`, list): Up to 5 ARNs to notify on entering ALARM, for example an SNS topic ARN.
- OK actions (`ok_actions`, list): Up to 5 ARNs to notify on returning to OK.
- Insufficient data actions (`insufficient_data_actions`, list): Up to 5 ARNs to notify on INSUFFICIENT_DATA.
- Actions enabled (`actions_enabled`, true/false): Whether the actions above run. Default on. Default: `true`.
- Tags (`tags`, object): Tags as key: value pairs. Only applied when the alarm is created, not on an update.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "alarm_name": "high-cpu",
    "comparison_operator": "GreaterThanThreshold",
    "evaluation_periods": 2,
    "metric_name": "CPUUtilization",
    "namespace": "AWS/EC2",
    "period": 300,
    "saved": true,
    "statistic": "Average",
    "threshold": 80.0
  }
}
```

### Delete alarms

Delete up to 100 alarms by name. There is no undo. Names that do not exist are skipped while the rest are deleted.

**Inputs**

- Alarm names (`alarm_names`, list, required): The exact names of the alarms to delete.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "alarm_names": [
      "high-cpu"
    ],
    "count": 1,
    "deleted": true
  }
}
```

### Delete dashboards

Delete one or more dashboards. There is no undo.

**Inputs**

- Dashboards (`dashboard_names`, list, required): The dashboards to delete (up to 100).

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "dashboard_names": [
      "ops"
    ],
    "deleted": true
  }
}
```

### Delete log group

Delete a log group with all its streams and events. There is no undo.

**Inputs**

- Log group (`log_group_name`, text, required): The log group's name, for example /aws/lambda/my-function, or its ARN. Use List log groups to find one.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "deleted": true,
    "log_group_name": "/myapp/production"
  }
}
```

### Get alarm history

Read alarms' state changes, configuration updates and actions (kept for 30 days), newest first.

**Inputs**

- Alarm name (`alarm_name`, text): Only this alarm. Leave empty for every alarm.
- Entry type (`history_item_type`, text): Only this kind of entry. One of: `ConfigurationUpdate` (Configuration updates), `StateUpdate` (State changes), `Action` (Actions taken).
- Alarm types (`alarm_types`, list): Only these kinds of alarm. One or more of: `MetricAlarm` (Metric alarms), `CompositeAlarm` (Composite alarms), `LogAlarm` (Log alarms).
- From (`start_time`, date and time): From this time.
- To (`end_time`, date and time): Up to this time. Leave empty for now.
- Order (`scan_by`, text): Order of the entries. Default newest first. One of: `TimestampDescending` (Newest first), `TimestampAscending` (Oldest first).
- Max records (`max_records`, number): How many per page, 1-100. Default 100. From 1 to 100.
- Next token (`next_token`, text): The 'next_token' from a previous page, to read the next one.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "has_more": false,
    "items": [
      {
        "alarm_name": "high-cpu",
        "alarm_type": "MetricAlarm",
        "history_data": {
          "version": "1.0"
        },
        "history_item_type": "StateUpdate",
        "history_summary": "Alarm updated from OK to ALARM",
        "timestamp": "2026-09-29T09:05:00Z"
      }
    ],
    "next_token": null
  }
}
```

### Get dashboard

Read a dashboard's body (its widgets) and ARN.

**Inputs**

- Dashboard (`dashboard_name`, text, required): Pick a dashboard, or type its name.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "dashboard_arn": "arn:aws:cloudwatch::123456789012:dashboard/ops",
    "dashboard_body": {
      "widgets": []
    },
    "dashboard_body_text": "{\"widgets\":[]}",
    "dashboard_name": "ops",
    "widget_count": 0
  }
}
```

### Get metric statistics

Read a metric's average, sum, minimum, maximum, sample count or percentiles over a time window, one datapoint per period, oldest first. Defaults to the last 3 hours in 5-minute periods.

**Inputs**

- Namespace (`namespace`, text, required): The metric's namespace, for example AWS/EC2 or your own 'MyApp'.
- Metric name (`metric_name`, text, required): The metric's name, for example CPUUtilization.
- Dimensions (`dimensions`, object): The metric's dimensions as name: value pairs, exactly as published (for example InstanceId: i-0123456789abcdef0).
- From (`start_time`, date and time): From this time. Leave empty for 3 hours ago.
- To (`end_time`, date and time): Up to this time. Leave empty for now.
- Period (seconds) (`period`, number): Seconds per datapoint: a multiple of 60 (or 1, 5, 10, 20, 30 for high-resolution metrics). Default 300. From 1 to 86400.
- Statistics (`statistics`, list): Which statistics to read. Default Average. One or more of: `SampleCount`, `Average`, `Sum`, `Minimum`, `Maximum`.
- Percentiles (`extended_statistics`, list): Percentiles instead of statistics, for example p99 or p95. Up to 10.
- Unit (`unit`, text): The unit of the values. Leave empty for none. One of: `Seconds`, `Microseconds`, `Milliseconds`, `Bytes`, `Kilobytes`, `Megabytes`, `Gigabytes`, `Terabytes`, `Bits`, `Kilobits`, and 17 more.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "datapoints": [
      {
        "average": 12.4,
        "extended_statistics": {},
        "maximum": null,
        "minimum": null,
        "sample_count": 5.0,
        "sum": null,
        "timestamp": "2026-09-29T09:00:00Z",
        "unit": "Percent"
      }
    ],
    "end_time": "2026-09-29T09:00:00Z",
    "label": "CPUUtilization",
    "latest": {
      "average": 12.4,
      "extended_statistics": {},
      "maximum": null,
      "minimum": null,
      "sample_count": 5.0,
      "sum": null,
      "timestamp": "2026-09-29T09:00:00Z",
      "unit": "Percent"
    },
    "metric_name": "CPUUtilization",
    "namespace": "AWS/EC2",
    "period": 300,
    "start_time": "2026-09-29T06:00:00Z"
  }
}
```

### Get query results

Read a Logs Insights query's rows. Set a wait time to wait for a query that is still running; otherwise check 'complete'. Results are kept for 7 days.

**Inputs**

- Query id (`query_id`, text, required): The query_id from Start Logs Insights query.
- Wait (seconds) (`wait_seconds`, number): Wait up to this long, 0-60, for the query to finish. Default 0 (return straight away). From 0 to 60.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "complete": true,
    "count": 1,
    "query_id": "12ab3456-12ab-123a-789e-1234567890ab",
    "rows": [
      {
        "@message": "ERROR payment declined order=1042",
        "@ptr": "CmAKJgoiMTIzNDU2Nzg5MDEyOi9teWFwcC9wcm9kdWN0aW9u",
        "@timestamp": "2026-09-29 09:00:00.000"
      }
    ],
    "statistics": {
      "bytes_scanned": 14000.0,
      "log_groups_scanned": 1.0,
      "records_matched": 1.0,
      "records_scanned": 120.0
    },
    "status": "Complete"
  }
}
```

### List alarms

List alarms with their current state, by name, name prefix, state or type.

**Inputs**

- Alarm names (`alarm_names`, list): Only these alarms (exact names, up to 100).
- Name prefix (`alarm_name_prefix`, text): Only alarms whose name starts with this. Not with Alarm names.
- State (`state_value`, text): Only alarms in this state. One of: `OK`, `ALARM`, `INSUFFICIENT_DATA`.
- Alarm types (`alarm_types`, list): Which kinds of alarm. Default metric alarms only. One or more of: `MetricAlarm` (Metric alarms), `CompositeAlarm` (Composite alarms), `LogAlarm` (Log alarms).
- Action prefix (`action_prefix`, text): Only alarms with an action ARN starting with this, for example an SNS topic ARN.
- Max records (`max_records`, number): How many per page, 1-100. Default 50. From 1 to 100.
- Next token (`next_token`, text): The 'next_token' from a previous page, to read the next one.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "alarm_names": [
      "high-cpu"
    ],
    "composite_alarms": [],
    "count": 1,
    "has_more": false,
    "in_alarm_count": 0,
    "log_alarms": [],
    "metric_alarms": [
      {
        "actions_enabled": true,
        "alarm_actions": [
          "arn:aws:sns:us-east-1:123456789012:alerts"
        ],
        "alarm_arn": "arn:aws:cloudwatch:us-east-1:123456789012:alarm:high-cpu",
        "alarm_description": "CPU above 80% for 10 minutes",
        "alarm_name": "high-cpu",
        "comparison_operator": "GreaterThanThreshold",
        "configuration_updated_at": "2026-09-29T08:00:00Z",
        "datapoints_to_alarm": null,
        "dimensions": {
          "InstanceId": "i-0123456789abcdef0"
        },
        "evaluation_periods": 2,
        "evaluation_state": null,
        "extended_statistic": null,
        "insufficient_data_actions": [],
        "metric_name": "CPUUtilization",
        "namespace": "AWS/EC2",
        "ok_actions": [],
        "period": 300,
        "state_reason": "Threshold Crossed: 2 datapoints were not greater than 80.0",
        "state_reason_data": {
          "statistic": "Average",
          "version": "1.0"
        },
        "state_transitioned_at": "2026-09-29T09:05:00Z",
        "state_updated_at": "2026-09-29T09:05:00Z",
        "state_value": "OK",
        "statistic": "Average",
        "threshold": 80.0,
        "treat_missing_data": "missing",
        "unit": null
      }
    ],
    "next_token": null
  }
}
```

### List dashboards

List the account's dashboards, optionally by name prefix.

**Inputs**

- Name prefix (`dashboard_name_prefix`, text): Only dashboards whose name starts with this.
- Next token (`next_token`, text): The 'next_token' from a previous page, to read the next one.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "dashboards": [
      {
        "dashboard_arn": "arn:aws:cloudwatch::123456789012:dashboard/ops",
        "dashboard_name": "ops",
        "last_modified": "2026-09-29T08:00:00Z",
        "size": 250
      }
    ],
    "has_more": false,
    "next_token": null
  }
}
```

### List log groups

List log groups in the region, by name prefix or by a text the name contains. Up to 50 per page.

**Inputs**

- Name prefix (`log_group_name_prefix`, text): Only groups whose name starts with this.
- Name contains (`log_group_name_pattern`, text): Only groups whose name contains this (case-insensitive). Not with Name prefix. Returns only name, ARN and creation time.
- Log class (`log_group_class`, text): Only groups of this class. One of: `STANDARD`, `INFREQUENT_ACCESS` (Infrequent Access (cheaper)).
- Limit (`limit`, number): How many per page, 1-50. Default 50. From 1 to 50.
- Next token (`next_token`, text): The 'next_token' from a previous page, to read the next one.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "has_more": false,
    "log_group_names": [
      "/myapp/production"
    ],
    "log_groups": [
      {
        "created_at": "2026-09-29T08:00:00Z",
        "data_protection_status": null,
        "deletion_protection_enabled": false,
        "kms_key_id": null,
        "log_group_arn": "arn:aws:logs:us-east-1:123456789012:log-group:/myapp/production",
        "log_group_class": "STANDARD",
        "log_group_name": "/myapp/production",
        "metric_filter_count": 0,
        "retention_in_days": 30,
        "stored_bytes": 10240
      }
    ],
    "next_token": null
  }
}
```

### List metrics

List the metrics in the connected region, optionally by namespace, name or dimension. Up to 500 per page.

**Inputs**

- Namespace (`namespace`, text): Only this namespace, for example AWS/EC2.
- Metric name (`metric_name`, text): Only metrics with this name.
- Dimensions (`dimensions`, object): Only metrics with these dimensions, as name: value. Leave a value empty to match any value of that dimension.
- Active in the last 3 hours (`recently_active`, true/false): Only metrics that received data in the last 3 hours. Default: `false`.
- Next token (`next_token`, text): The 'next_token' from a previous page, to read the next one.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "has_more": false,
    "metrics": [
      {
        "dimensions": {
          "InstanceId": "i-0123456789abcdef0"
        },
        "metric_name": "CPUUtilization",
        "namespace": "AWS/EC2"
      }
    ],
    "next_token": null
  }
}
```

### Publish metric data point

Publish one value to a custom metric, creating the metric the first time. A new metric can take up to 15 minutes to appear in List metrics, but can be read with Get metric statistics straight away.

**Inputs**

- Namespace (`namespace`, text, required): Your namespace, for example 'MyApp'. It must not start with 'AWS/'.
- Metric name (`metric_name`, text, required): The metric's name, for example CPUUtilization.
- Value (`value`, number, required): The value to record.
- Unit (`unit`, text): The unit of the values. Leave empty for none. One of: `Seconds`, `Microseconds`, `Milliseconds`, `Bytes`, `Kilobytes`, `Megabytes`, `Gigabytes`, `Terabytes`, `Bits`, `Kilobits`, and 17 more.
- Dimensions (`dimensions`, object): The metric's dimensions as name: value pairs, exactly as published (for example InstanceId: i-0123456789abcdef0).
- Timestamp (`timestamp`, date and time): When the value was measured, within the last two weeks. Leave empty for now.
- High resolution (`high_resolution`, true/false): Store with one-second resolution instead of one minute. High-resolution metrics cost more. Default: `false`.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "dimensions": {
      "Environment": "production"
    },
    "metric_name": "OrdersPlaced",
    "namespace": "MyApp",
    "published": true,
    "timestamp": null,
    "unit": "Count",
    "value": 3.0
  }
}
```

### Save dashboard

Create a dashboard, or replace an existing dashboard's whole body. Three dashboards are free each month.

**Inputs**

- Dashboard (`dashboard_name`, text, required): Pick a dashboard to replace, or type a new name (letters, digits, '-' and '_').
- Dashboard body (`dashboard_body`, object, required): The dashboard as JSON: an object with a 'widgets' list. Copy one from an existing dashboard's Actions > View/edit source in the CloudWatch console.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "dashboard_name": "ops",
    "saved": true,
    "validation_messages": [],
    "warning_count": 0
  }
}
```

### Search log events

Find log events in a log group that match a filter pattern, oldest first. A page can be empty while more remain - check has_more. Setting a From time makes searches faster.

**Inputs**

- Log group (`log_group_name`, text, required): The log group's name, for example /aws/lambda/my-function, or its ARN. Use List log groups to find one.
- Filter pattern (`filter_pattern`, text): A CloudWatch filter pattern, for example ERROR, "payment declined" or { $.level = "error" }. Leave empty for every event.
- Log streams (`log_stream_names`, list): Only these log streams (up to 100).
- Log stream prefix (`log_stream_name_prefix`, text): Only streams whose name starts with this. Not with Log streams.
- From (`start_time`, date and time): From this time.
- To (`end_time`, date and time): Up to this time. Leave empty for now.
- Limit (`limit`, number): The most events to return, 1-10000. Default 10000. From 1 to 10000.
- Next token (`next_token`, text): The 'next_token' from a previous page, to read the next one.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "count": 1,
    "events": [
      {
        "event_id": "38245672903463829184735643986710000000000000000000000000",
        "ingested_at": "2026-09-29T09:00:01Z",
        "log_stream_name": "web-1",
        "message": "ERROR payment declined order=1042",
        "timestamp": "2026-09-29T09:00:00Z"
      }
    ],
    "has_more": false,
    "log_group_name": "/myapp/production",
    "messages": [
      "ERROR payment declined order=1042"
    ],
    "next_token": null
  }
}
```

### Set alarm state (test)

Force an alarm into a state to test its actions - they run as if it happened. The alarm returns to its real state at its next evaluation, usually within a minute.

**Inputs**

- Alarm name (`alarm_name`, text, required): The alarm's exact name (case-sensitive).
- State (`state_value`, text, required): The state to set. One of: `OK`, `ALARM`, `INSUFFICIENT_DATA`.
- Reason (`state_reason`, text, required): Why, as shown in the alarm's history.
- Reason data (`state_reason_data`, object): Optional machine-readable detail, as key: value pairs.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "alarm_name": "high-cpu",
    "set": true,
    "state_value": "ALARM"
  }
}
```

### Start Logs Insights query

Start a CloudWatch Logs Insights query over one or more log groups. Read the rows with Get query results. Defaults to the last hour. Data scanned counts toward the free 5 GB a month.

**Inputs**

- Log groups (`log_group_names`, list): The log groups to query (names or ARNs, up to 50). Not needed for SQL, which names them in FROM.
- Query (`query_string`, text, required): The query.
- From (`start_time`, date and time): From this time. Leave empty for an hour ago.
- To (`end_time`, date and time): Up to this time. Leave empty for now.
- Query language (`query_language`, text): The query's language. Default Logs Insights QL. One of: `CWLI` (Logs Insights QL), `SQL`, `PPL`.
- Row limit (`limit`, number): The most rows to return, 1-10000, if the query has no limit of its own. From 1 to 10000.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "end_time": "2026-09-29T09:00:00Z",
    "log_group_names": [
      "/myapp/production"
    ],
    "query_id": "12ab3456-12ab-123a-789e-1234567890ab",
    "query_language": "CWLI",
    "start_time": "2026-09-29T08:00:00Z"
  }
}
```

### Write log events

Write one or more log lines to a log stream. Events are sorted into time order; ones without a time are stamped now. Events more than 14 days old or 2 hours ahead are rejected, and the step fails only if every event was.

**Inputs**

- Log group (`log_group_name`, text, required): The log group's name, for example /aws/lambda/my-function, or its ARN. Use List log groups to find one.
- Log stream (`log_stream_name`, text, required): The log stream's name within the group. No ':' or '*'.
- Events (`events`, list, required): The log lines. Each item is text, or an object with 'message' and an ISO-8601 'timestamp'.
- Create the stream if missing (`create_stream_if_missing`, true/false): Create the log stream first if it does not exist. Default: `false`.

**Outputs**

- `result` (object)

**Example output**

```json
{
  "result": {
    "accepted_count": 2,
    "expired_count": 0,
    "first_timestamp": "2026-09-29T09:00:00Z",
    "last_timestamp": "2026-09-29T09:00:00Z",
    "log_group_name": "/myapp/production",
    "log_stream_name": "web-1",
    "rejected_count": 0,
    "too_new_count": 0,
    "too_old_count": 0
  }
}
```