# Filter CloudWatch Logs events

Canonical URL: https://docs.fuse.init.inc/integrations/aws/actions/cloudwatch_logs.events.filter

Filter log events in one log group. start_time and end_time must be at most seven days apart. newest_first requires start_time on or after 2024-01-01T00:00:00Z. Does not unmask sensitive data. Requires logs:FilterLogEvents.

Action ID: `cloudwatch_logs.events.filter`
Provider: AWS (`aws`)
Contract version: 1

## Risk and exposure

- Risk: Read
- Idempotency: Safe — Safe to retry without coordination; repeats do not create additional side effects.
- Availability: Default
- Exposure: REST, SDK, MCP
- MCP hints: readOnly=true, destructive=false, idempotent=true, openWorld=true

## Required scopes

- `logs:FilterLogEvents`

## Input schema fields

- `region`
- `log_group`
- `start_time`
- `end_time`
- `filter_pattern`
- `log_stream_names`
- `log_stream_names[]`
- `direction`
- `page_size`
- `cursor`

## Output schema fields

- `events`
- `events[]`
- `events[].event_id`
- `events[].log_stream_name`
- `events[].message`
- `events[].event_timestamp`
- `events[].ingestion_timestamp`
- `next_cursor`

Provider overview: https://docs.fuse.init.inc/integrations/aws
Actions index: https://docs.fuse.init.inc/integrations/aws/actions
Exact canonical JSON contract: https://docs.fuse.init.inc/api/catalog/v1/providers/aws/actions/cloudwatch_logs.events.filter
Deployment-effective discovery: https://api.fuse.init.inc/v1/tenants/%7Btenant_id%7D/providers/aws/actions