aws logs: The specified log group does not exist

Question

I'm trying to grab logs from Cloudwatch with this CLI usage:

cat cli-get-log-events.json    
{
    "logGroupName": "/aws/lambda/my-group", 
    "logStreamName": "2019/03/30/[$LATEST]dec1626296d84819be42f2ef615f292e", 
    "startTime": 1553977650000, 
    "endTime": 1553977748000, 
    "limit": 10, 
    "startFromHead": true
}


aws logs get-log-events --cli-input-json file://cli-get-log-events.json

But I see this error in the response:

An error occurred (ResourceNotFoundException) when calling the GetLogEvents operation: The specified log group does not exist.

Answer 1

Your problem could be the region.

It turned out it wasn't for the OP but it might be for you looking at this question!

For example I had to add --region 'us-east-2' to fix a similar problem of log group not found when calling from the CLI

Answer 2

The problem was that my log group was in a different account.

I was able to realize my problem when I attempted to list all log groups beginning with a common prefix, e.g. rather than "my-lambda", I used "my":

aws logs describe-log-groups --log-group-name-prefix /aws/lambda/my

As soon as I realized that no log groups were being listed for a prefix that I expected many log groups, and other prefixes did show some log groups, I realized I needed to use a different account. I leveraged the AWS CLI Profiles to access that account with this usage:

aws logs describe-log-groups --profile prd --log-group-name-prefix /aws/lambda/my

then I saw the many expected log groups, confirming their existence in the right account.

The fix to get the logs I needed should therefore be:

aws logs get-log-events --profile prd --cli-input-json file://cli-get-log-events.json

Unfortunately I get the following error:

An error occurred (ResourceNotFoundException) when calling the GetLogEvents operation: The specified log stream does not exist.

There is a mentionable solution for this error message over at: AWS Cloudwatch log stream name not recognised

But in my case, I think I just copied the wrong name of the log stream. I grabbed the name of the stream from the console again, pasted it into my cli input file.

My final usage was:

aws logs get-log-events --cli-input-json file://cli-get-log-events.json --profile prd > logs-xyz.json