Skip to main content
This guide demonstrates how to perform near real-time log monitoring and deeper analysis using AWS CloudWatch Log Analytics (Live Tail) and CloudWatch Logs Insights. You’ll learn how to start a Live Tail to watch logs as they arrive and how to run and refine Logs Insights queries to filter, search, and aggregate log data from Lambda and other services.

​
Open CloudWatch Log Analytics

  1. In the AWS Console, open the CloudWatch service.
  2. In the left-hand navigation, under “Logs”, select Log Analytics.
  3. Set the data source to Log groups, then choose the Lambda log group you want to inspect (for this demo it is /aws/lambda/xray-demo).
A screenshot of the AWS CloudWatch Log Analytics console with the log group picker open, showing Lambda log groups (e.g., /aws/lambda/xray-demo) and filters/time-range controls. The AWS console header and account/region bar are visible across the top.
Click outside the log group picker to confirm your selection.

​
Start Live Tail (near real-time)

Live Tail streams new log events as they are ingested into CloudWatch Logs so you can observe activity in near real-time. With the Lambda log group selected, start Live Tail and then invoke the function (for example, via the Lambda console Test button) to generate new events — they should appear immediately. CloudWatch provides a SOURCE block to scope the Live Tail session. Example SOURCE query used internally by the console:
Sample Live Tail output (timestamps and RequestIds shortened):
Live Tail is best for immediate troubleshooting (errors, cold starts, runtime diagnostics). Use it to validate deployments or reproduce issues in real time. For historical analysis, aggregates, or large-scale searching, switch to Logs Insights.

​
Analyze logs with Logs Insights

Open Logs Insights in a new tab so Live Tail can continue running while you query stored log events. Make sure your Logs Insights query is scoped to the same log group and the correct time range. Basic query to list recent events (timestamp and message), newest first, limited to 20:
If you prefer an explicit SOURCE clause (the console will auto-add it when you pick a log group), use:
Example result table (sample output):

​
Common Logs Insights clauses and examples

​
Filtering for specific events

Filter for Lambda START lines:
Filter for errors (case-insensitive):
If a query returns “0 matches,” there were no log events matching that pattern in the selected time range for the chosen log group.
Ensure your IAM principal has the required CloudWatch Logs permissions (e.g., logs:StartQuery, logs:GetQueryResults, logs:FilterLogEvents, and logs:Tail) to run Logs Insights queries and Live Tail. Live Tail streams recent ingestion — if no events appear, check Lambda invocation, log retention, and permissions.

​
Quick reference and takeaway

  • Live Tail: near real-time streaming of log events as they are ingested — ideal for immediate troubleshooting and validation.
  • Logs Insights: interactive query language to search, filter, and aggregate stored logs for historical analysis and dashboards.
  • Build concise queries with fields, filter, sort, and limit. Add stats and bin() for aggregations over time.
Combined example: use SOURCE, filter for START, and list recent matches:
With Live Tail for immediate visibility and Logs Insights for deeper queries, you can quickly investigate Lambda behavior, surface errors, and validate performance after deployments.

Watch Video

Practice Lab