Repository navigation
AWS CloudWatchLogs: open real-cloud parity gaps #1476
Description
cloudemu's CloudWatchLogs emulation still differs from real AWS in the ways listed below. Each item is a separate fix, so pick any one and open a PR for it against development. Comment here with the item you're taking so two people don't work on the same one.
Check the expected behaviour against the AWS API reference and the real CLI or SDK. A good fix goes in the provider (providers/aws/...) so the Go library and cloudemu serve behave the same, and adds a test that fails before the fix. See CONTRIBUTING.md for setup.
High
- Logs Insights absent: StartQuery/GetQueryResults/StopQuery/DescribeQueries/GetLogRecord/GetLogGroupFields (
server/aws/cloudwatchlogs/handler.go dispatch has no Insights cases) - Filter-pattern language unimplemented (whole-string substring) for FilterLogEvents/metric/subscription filters
Medium
- DeleteRetentionPolicy missing (UnknownOperationException); no way back to never-expire (
not in handler.go switch) - ListLogGroups (2023 account-level op) not wired to JSON-RPC dispatcher (
driver has ListLogGroups but handler.go has no case) - CreateExportTask/DescribeExportTasks/CancelExportTask (S3 export) missing
- PutLogEvents accepts events older than 14 days / retention (no InvalidParameterException) (
no timestamp-window check in server/aws/cloudwatchlogs/operations.go) - PutLogEvents accepts events more than 2h in the future
- Retention cutoff applied in GetLogEvents but not FilterLogEvents (contradictory reads) (
cloudwatchlogs.go filterEvents takes retentionCutoff; matchEvents (FilterLogEvents) has none) - Retention expiry is synchronous read-time hiding with no grace period (real AWS deletes async)
Low
- Put/Get/DeleteDataProtectionPolicy missing
- PutAccountPolicy/DescribeAccountPolicies; Associate/DisassociateKmsKey; StartLiveTail missing
- PutLogEvents nextSequenceToken hardcoded "0" (
operations.go putLogEvents writes NextSequenceToken "0"; response-shape realism)
Activity
fix(aws-cloudwatchlogs): retention, ingest window, ListLogGroups and …
NitinKumar004 commentedon Oct 21, 2026
#1655 fixed DeleteRetentionPolicy, ListLogGroups, the PutLogEvents 14-day / retention / 2-hour window with rejectedLogEventsInfo, retention in FilterLogEvents and a real sequence token. It also adds Associate/DisassociateKmsKey and kmsKeyId/logGroupClass on CreateLogGroup. Expired events are now purged, but the deletion lag of real AWS isn't modelled, so that item stays open.
fix(aws-cloudwatchlogs): filter pattern language for log, metric and …
NitinKumar004 commentedon Oct 21, 2026
#1656 adds the filter-pattern language for FilterLogEvents, metric and subscription filters, and TestMetricFilter, covering unstructured terms, %regex% and JSON patterns, with AWS's syntax limits and regex quotas. Space-delimited patterns follow in a separate PR, so that item stays open.
fix(aws-cloudwatchlogs): space-delimited filter patterns and metric v…
NitinKumar004 commentedon Oct 21, 2026
#1658 adds space-delimited patterns and metric value extraction ($field,$N, $ .path). With #1656, the filter-pattern language now works for FilterLogEvents, metric filters and subscription filters, so that item is done.
fix(aws-cloudwatchlogs): metric filter dimensions, default values, un…
NitinKumar004 commentedon Oct 22, 2026
#1660 adds metric filter transformation parity:
fix(aws-cloudwatchlogs): Logs Insights queries and query engine core (#…
NitinKumar004 commentedon Oct 22, 2026
#1661 adds the six Logs Insights ops (StartQuery, GetQueryResults, StopQuery, DescribeQueries, GetLogRecord, GetLogGroupFields).
The query engine supports fields, filter, sort, limit and display, plus the system fields and JSON field discovery. Queries move through the AWS lifecycle states. The 100-concurrent-query limit and the 60-minute timeout are enforced, and a bad query returns MalformedQueryException with a compile error.
stats, parse and dedup follow in the next PR, so the Insights item stays open.
NitinKumar004 commentedon Oct 22, 2026
#1664 adds the Logs Insights stats, parse and dedup commands, plus bin, datefloor and dateceil. Chaining follows the documented rules. Together with #1661, the Logs Insights item is done.
NitinKumar004 commentedon Oct 23, 2026
#1686 adds export tasks to S3 (CreateExportTask, DescribeExportTasks, CancelExportTask).
NitinKumar004 commentedon Oct 23, 2026
#1700 adds data protection policies, with real masking at ingest and unmask, and account policies of all types. With #1655, Associate/DisassociateKmsKey is also done, so the only open parts of the combined Low line are StartLiveTail and the 72h retention deletion lag.