# Cloudwatch Logs

**Sync Type: Incremental**

## Overview
Collects log events from AWS CloudWatch Logs to monitor application logs, system logs, and AWS service logs across your environment for security analysis and operational insights.

## Functionality

On initialization, Monad discovers all CloudWatch log groups in the specified region. For each log group, the connector retrieves log events using time-based filtering and maintains state to ensure incremental updates on subsequent runs. Only new log events since the last sync are collected, minimizing duplicates and API calls.

## Requirements
- [IAM Role Assumption / Static Credentials](./index.mdx#authentication-methods)
- Example permission to attach to the role/user:
```json 
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "",
			"Effect": "Allow",
			"Action": [
        "logs:DescribeLogGroups",
        "logs:FilterLogEvents"
			],
			"Resource": "*"
		}
	]
}
```

## Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

#### Settings

| Setting  | Type   | Required | Description                                                                                                                                                     |
| -------- | ------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Region   | string | Yes      | The AWS region where Cloudwatch is enabled.                                                                                                                      |
| Role ARN | string | Yes      | The ARN of the IAM role to assume for accessing Cloudwatch.                                                                                                      |
| Backfill Start Time | string | No | The date to start fetching data from. If not specified, no past records will be fetched. |

### Secrets (Static Credentials Only)

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| **Access Key** | string | Conditional | AWS Access Key ID |
| **Secret Key** | string | Conditional | AWS Secret Access Key |

> ⚠️ **Authentication**: Choose either Role ARN (recommended) or static credentials. See [AWS Authentication Guide](./index.mdx#authentication-methods) for setup instructions.

### Related Articles
- [AWS Cloudwatch Logs User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html)
- [Cloudwatch Logs API Reference](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/Welcome.html)

## Sample Record

```json
{
  "EventId": "19290253317859809123455432178906645308301437257699635872",
  "IngestionTime": 1761939524706,
  "LogStreamName": "EC2-Log-Stream",
  "Message": "User login activity",
  "Timestamp": 1761939586709
}
```

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.