Guide / Logs, metrics and lenses
Logs, metrics and lenses
Several views open inside the detail pane rather than as full-screen modals. Each takes over the keymap while open; Esc closes it and Z makes the pane full-width.
| Key | View |
|---|---|
| m | CloudWatch charts: [ / ] change the window, r refreshes |
| t | Live log tail: [ / ] widen the lookback, s flips to search, w wraps long lines |
| f | Log search (server-side filter pattern) · CloudTrail event filter · ECS/execution status filter |
| W | Change timeline: who changed this resource; [ / ] widen to 90 days, a includes reads |
| U | Referenced by: which loaded resources mention this one |
| N | Network access: the effective security-group rule table |
| o | S3 object browser |
| i | DynamoDB item browser (Scan / Query) |
| s | SSM Session Manager · ECS Exec · assume an Organizations member-account role |
| x / Y | Reveal / copy a secret or SSM parameter value (never cached, never logged) |
| O | Open this resource in the AWS Console |
Metrics (m)
Charts for 53 resource kinds, each with the right namespace and dimension set: EC2, EBS, Lambda, ECS services and tasks, RDS, load balancers, DynamoDB, SQS, Kinesis, MSK, API Gateway, CloudFront, NAT gateways, VPN and Direct Connect, and so on. On a CloudWatch dashboard, m renders the dashboard itself: its widgets laid out on the console’s own grid, with Tab walking a widget cursor and Enter zooming one to the whole pane.
GetMetricDatabills per metric requested, so the dashboard view caps the number of series it fetches and never fires automatically.
Log tail and search (t, f)
t tails a log group live, seeded from a lookback window (default
15 minutes). It also works on things that have logs: a Lambda function, an
RDS instance, an ECS task, a WAF web ACL, a CloudTrail trail, a Step
Functions execution, a CodeBuild project. f on a log group runs a
one-shot server-side search with a CloudWatch filter pattern over a chosen
range; s flips a live tail into a search on the same group.
y copies the buffer, e opens it in $EDITOR.
Change timeline (W)
“What changed around this resource?” Four sources merged newest-first, each
row wearing a badge: CloudTrail events that name the resource, CloudWatch
alarm state changes, CloudFormation stack events for the owning stack, and
ECS deployments. Works on any resource, from either pane.
Enter opens the raw event in $EDITOR.
Referenced by (U) and network access (N)
U is the reverse of ownership: every loaded resource that mentions the selected one, by id, name, ARN or tag. It scans only what is cached, so it makes no API calls and says how much it covered.
N on anything with security groups (an instance, an RDS instance, a Lambda, a load balancer…) shows the effective rule table across every attached group in one view, with open-to-world sources highlighted. Enter jumps to the group a row came from.
The editor (e)
e opens the current resource in $EDITOR (falling back to
vim). What it opens depends on context: a fetched IAM policy document, a
CloudFormation template, an S3 object, a Step Functions payload, a raw
finding JSON, or by default the full detail-pane snapshot as JSON, so
e always opens something useful.