AWS Cloud9 is no longer available to new customers. Existing customers of AWS Cloud9 can continue to use the service as normal. [Learn more](https://aws.amazon.com/blogs/devops/how-to-migrate-from-aws-cloud9-to-aws-ide-toolkits-or-aws-cloudshell/)

# Working with CloudWatch Logs using the AWS Toolkit
<a name="cloudwatch-logs-toolkit"></a>

You can use Amazon CloudWatch Logs to centralize the logs from all of your systems and applications and the AWS services that you use, in a single, highly scalable service. You can then easily view them, search them for specific error codes or patterns, filter them based on specific fields, or archive them securely for future analysis. For more information, see [What Is Amazon CloudWatch Logs?](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatchLogs.html) in the *Amazon CloudWatch User Guide*.

The following topics describe how to use the AWS Toolkit to work with CloudWatch Logs in an AWS account:

**Topics**
+ [Viewing CloudWatch log groups and log streams](viewing-CloudWatch-logs.md)
+ [Working with CloudWatch log events](working-CloudWatch-log-events.md)

# Viewing CloudWatch log groups and log streams using the AWS Toolkit
<a name="viewing-CloudWatch-logs"></a>

A *log stream* is a sequence of log events that share the same source. Each separate source of logs into CloudWatch Logs makes up a separate log stream.

A *log group* is a group of log streams that share the same retention, monitoring, and access control settings. You can define log groups and specify which streams to put into each group. There's no limit on the number of log streams that can belong to one log group. 

For more information, see [Working with Log Groups and Log Streams ](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Working-with-log-groups-and-streams.html) in the *Amazon CloudWatch User Guide*.

**Topics**
+ [Viewing log groups and log streams with the **CloudWatch Logs** node](#viewing-log-groups)

## Viewing log groups and log streams with the **CloudWatch Logs** node
<a name="viewing-log-groups"></a>

1. Open AWS Explorer, if it isn't already open.

1. Click the **CloudWatch Logs** node to expand the list of log groups.

   The log groups for the current AWS Region are displayed under the **CloudWatch Logs** node.

1. To view the log streams in a specific log group, open the context (right-click) menu for the name of the log group, and then choose **View Log Streams**.

1. The log group's contents are displayed under the **Select a log stream** heading. 

   You can choose a specific stream from the list or filter the streams by entering text in the field.

   After you choose a stream, the events in that stream are displayed in the IDE's **Log Streams** window. For information about interacting with the log events in each stream, see [Working with CloudWatch log events](working-CloudWatch-log-events.md).

# Working with CloudWatch log events in log streams
<a name="working-CloudWatch-log-events"></a>

After you opened the **Log Stream** window, you can access the log events in each stream. Log events are records of activity recorded by the application or resource being monitored.

**Topics**
+ [Viewing and copying log stream information](#viewing-log-events)
+ [Save the contents of the log stream editor to a local file](#saving-CW-logs)

## Viewing and copying log stream information
<a name="viewing-log-events"></a>

When you open a log stream, the **Log Stream** window displays that stream's sequence of log events. 

1. To find a log stream to view, open the **Log Stream** window. For more information, see [Viewing CloudWatch log groups and log streams](viewing-CloudWatch-logs.md).

   Each line listing an event is timestamped to show when it was logged. 

1. You can view and copy information about the stream's events using the following options:
   + **View events by time: **Display the latest and older log events by choosing **Load newer events** or **Load older events**. 
**Note**  
The **Log Stream** editor initially loads a batch of the most recent 10,000 lines of log events or 1 MB of log data, whichever is smaller. If you choose **Load newer events**, the editor displays events that were logged after the last batch was loaded. If you choose **Load older events**, the editor displays a batch of events that occurred before those currently displayed. 
   + **Copy log events:** Select the events to copy, then open the context (right-click) menu and select **Copy** from the menu.
   + **Copy the log stream's name:** Open the context (right-click) menu for the tab of the **Log Stream** window and choose **Copy Log Stream Name**.

## Save the contents of the log stream editor to a local file
<a name="saving-CW-logs"></a>

You can download the contents of the CloudWatch log stream editor to a `log` file on your local machine.

**Note**  
You can use this option to save to file only those log events that are currently displayed in the log stream editor. For example, suppose that the total size of a log stream is 5MB and only 2MB is loaded in the editor. Your saved file also contains only 2MB of log data. To display more data to be saved, choose **Load newer events** or **Load older events** in the editor. 

1. To find a log stream to copy, open the **Log Streams** window (see [Viewing CloudWatch log groups and log streams](viewing-CloudWatch-logs.md)).

1. Open the context (right-click) menu for the tab of the **Log Stream** window and choose **Save Current Log Content to File**

1. Use the dialog box to select or create a download folder for the log file, and choose **Save**.