User guide

Cloud Certainty TraceHound is a console for Amazon CloudWatch Logs that runs in your organisation's own AWS account. You see what every log group stores, ingests and costs, tidy up retention, search and explore events, follow one request across services, tail logs live, and keep and share queries and dashboards, across the AWS accounts and Regions your administrator connected.

Open the portal URL your administrator gave you and sign in with your company account. You see the log groups an administrator granted you; what you may do with each depends on your permissions:

Permissions are granted per AWS account (connection), Region and log group name pattern, so you may be able to read /aws/lambda/payments-* and only browse everything else. A log group no grant covers doesn't exist for you. Buttons for actions you can't take are greyed out, and their tooltip says why.

Some features depend on your organisation's plan (Starter, Team, Business or Enterprise). A feature the plan doesn't include shows a plan badge, for example Team plan. This guide notes the plan next to each such feature.

#Signing in

TraceHound uses your organisation's sign-in: AWS IAM Identity Center, another SAML or OIDC identity provider, or TraceHound's own user pool with multi-factor authentication. Your administrator chose one when installing TraceHound (Identity providers).

The first time you sign in you may see no log groups at all: nobody sees anything until an administrator gives them a grant. Ask your TraceHound administrator for access, naming the AWS account, the Region and the log groups you need (a prefix such as /aws/lambda/payments- is fine).

#Finding your way

The sidebar on the left has Overview; under Logs, Explore, Live tail, Trace and Log groups; under Analyse, Dashboards, Queries and History; under Cost, Storage and cost; then Snapshots and, for administrators, Administration. Its foot shows your plan and licence status, who you are with Sign out, the theme switch (System, Light, Dark) and Shortcuts. [ collapses the sidebar to icons.

Search or jump to (Ctrl+K, ⌘K on a Mac) finds log groups in every connection and Region you can see, your saved queries and dashboards, recent items and pages. Choose a log group, then press → for its actions: open it, explore it, tail it, trace a value, read its recent events (free of Logs Insights charges), open it in the AWS console or copy its name. Typing any text offers Search logs for "...", and an id-like value offers Trace "...".

Other shortcuts: / focuses the page's search box, ? lists every shortcut, and g followed by a letter goes to a page (g o Overview, g e Explore, g t Live tail, g r Trace, g l Log groups, g d Dashboards, g q Queries, g h History, g c Storage and cost, g s Snapshots, g a Administration).

#Overview

The Overview sums up every log group you can see, over every connection and Region:

Screenshot

• Log groups, Stored (with the change over 7 days), Ingested, 30 days (with the change against the previous 30 days), Estimated monthly cost, Never expire (with what a retention would save) and Orphaned (Lambda log groups whose function is gone). Each tile opens the matching list.
• Storage and ingestion: stored bytes and bytes ingested per day over 30 days, 90 days or a year (a year needs a plan that keeps a year of storage history).
• Recommendations: how many log groups each recommendation applies to, and what they would save a month.
• Top growers (stored bytes gained in 7 days) and Top cost (estimated monthly cost).
• Recent searches: your last searches and queries, with what they scanned and cost.
• Dashboards: the latest dashboards you can open, and the template gallery.
• For administrators, Collector: when the storage history was last recorded in each Region, with Collect now.

#Where the numbers come from

• Stored bytes are what CloudWatch reports for each log group, which it updates with a delay of up to a few hours. CloudWatch keeps no history of them, so TraceHound's collector records them once a day: the history starts the day TraceHound was installed (charts mark it Stored bytes history starts).
• Ingestion (bytes and events per day) comes from CloudWatch metrics. The collector reads the previous day every day, and 90 days back on its first run, so ingestion history reaches back before the install.
• Costs are estimates: see How costs are estimated. Your AWS bill is the record.
• Until the collector has run, sizes come straight from CloudWatch and growth, ingestion and full cost estimates are missing; the pages say so.

#Log groups

Log groups is the inventory: every log group you can browse, in every connection and Region, in one table.

Screenshot

Columns adds Growth 30 d, In 7 d, Events 1 d and Created, or hides columns. Select a column header to sort; missing values always sort last.

#Filters

• The filter box matches words anywhere in the name (orders api), and a minus excludes (-test). With * or ? it matches the whole name like a pattern (/aws/lambda/orders-*).
• Connection, Region, Class, Retention (Never expire, up to 7 days, 8 to 30 days, 31 to 90 days, 91 days to 1 year, over a year), Resource and Flags narrow the list. Active filters show as chips; Clear filters removes them.
• The filters, the sort and the grouping are in the page's address, so a link shows a colleague the same view.

What the flags mean:

#Grouping

Group shows the table by Resource type, as a Prefix tree (split on /) or by Tag, with the count, stored bytes, ingestion and cost of each group.

Screenshot

Tags are not part of CloudWatch's log group list, so TraceHound reads them per log group: when you open a log group's page, or with Load tags for N when you group by tag (up to 100 log groups per click). Log groups whose tags aren't loaded yet are grouped under Tags not loaded. Loaded tags are kept for your browser session.

#Acting on several log groups

Tick log groups (Shift selects a range, the header box selects every log group shown), then:

• Explore: search them in Explore (one connection and Region, at most 50, read on each);
• Tail: live tail them (one connection and Region, at most 10, read on each, no Infrequent Access);
• Trace: follow a value across them in Trace (one connection and Region, any number);
• Set retention: change their retention together (Team and above, see Changing retention);
• Export: the selected rows as CSV. Export CSV at the top exports every row shown. The CSV holds the inventory (names, sizes, ingestion, retention, cost, flags), never log events.

Keyboard: ↑ ↓ (or j k) move, Space selects, Enter opens, e explores the last hour, / focuses the filter.

TraceHound lists up to 20,000 log groups per Region; a Region with more shows the first 20,000 and says so. The list is shared by everyone and refreshed every 5 minutes; Refresh reads it again from CloudWatch.

#A log group's page

Open a log group for everything about it. The header shows its class and protections, when it was created and its owner tag, with Explore, Tail, Trace and Dashboard template (the template gallery with this log group filled in). Related links to the AWS resources it belongs to in the AWS console: worked out from its name (a Lambda function, an ECS cluster or service, an API Gateway stage, an RDS database, a CodeBuild project, a Step Functions state machine and others), from tags such as the CloudFormation stack, and from its subscription filters' destinations.

#Overview tab

Screenshot

• Tiles: Stored, Growth, 7 days, Ingested, 30 days, Events, 1 day, Estimated monthly cost and Retention.
• Storage and ingestion: stored bytes and bytes ingested per day over 7 days, 30 days, 90 days or a year, as far back as your plan keeps storage history.
• Monthly cost: the estimate split into ingestion and storage, with the prices used. For a busy Standard log group without metric filters it also says what the same data would cost in an Infrequent Access log group.
• Last 24 hours: incoming bytes and events from CloudWatch metrics, every 5 minutes.
• Retention: the current setting and a retention editor (see below).
• Settings: ARN, class, creation time, retention, stored bytes, encryption, data protection policy (its name and data identifiers), deletion protection, metric filters and the last day with ingestion.
• Tags, Metric filters, Subscription filters and Anomaly detectors.

A part that AWS refuses (for example because the connection's role doesn't cover this log group) is named, and the rest of the page still shows.

#Changing retention

Retention shows the current setting and New retention: one of CloudWatch's values (1 day to 10 years) or Never expire. TraceHound shows the bytes that would remain and the monthly saving before you Apply.

Screenshot

Changing retention needs the Team plan or above, a connection with the Manage access level and manage on the log group (administrators need only the first two). A shorter retention asks you to confirm first: CloudWatch then deletes events older than the new retention within a few days, and they can't be recovered. Delivery class log groups keep one day and their retention is managed by CloudWatch. Every change is recorded in the audit log with the old and new values.

#Events tab

Events lists the log group's events newest first, read with CloudWatch's FilterLogEvents, so it costs nothing in Logs Insights charges. Use it for a quick look; use Explore for searching many log groups, statistics and charts.

Screenshot

• Filter pattern takes CloudWatch's filter pattern syntax, which is case-sensitive. Syntax shows examples you can pick:

  Pattern	Matches
  ERROR	Events containing the term
  "Task timed out"	The exact phrase
  ERROR Exception	Both terms
  ?ERROR ?WARN	Either term
  ERROR -healthcheck	The first term but not the second
  { $.level = "ERROR" }	JSON events with that property
  { $.statusCode >= 500 && $.path != "/health" }	JSON comparisons
  [ip, user, ..., status = 5*, bytes]	Space-delimited events by position
  %timed? ?out%	A regular expression

  TraceHound checks the pattern before sending it (at most 1,024 characters, one line, closed quotes and brackets) and shows CloudWatch's own message if it still refuses it.

• Time range: 5 minutes to 7 days, or Custom. Search again reads up to now.

• Scroll, or choose Load more, to read further back. The list holds up to 5,000 events; narrow the range, the pattern or the stream to see older ones, or search in Explore.

• Open an event for its time, ingestion delay, stream and event id, with Copy message, Copy JSON (for JSON events), Show context, Open in Explore (5 minutes either side, searching for the event's request id or trace id when it has one), Only this stream and Open the stream in the AWS console.

• Show context shows 25 events before and after it in the same stream; Load more before and Load more after add 25 each time.

If CloudWatch couldn't search every stream in the range, the page says some events may be missing. Infrequent Access log groups have no Events tab list: CloudWatch doesn't allow FilterLogEvents on them. Search them in Explore instead.

#Streams tab

Streams lists the 50 streams with the latest events: first and last event, last ingestion and creation time, with a console link. Choose a stream to see its events.

#Storage and cost

Storage and cost shows what your log groups cost and where to save.

Screenshot

• Tiles: Estimated monthly cost, Ingestion (30 days), Storage, Insights and live tail, 30 days (administrators: what queries and live tail sessions run through TraceHound cost) and Potential saving from the recommendations.
• Storage growth: stored bytes of the largest log groups stacked over 30 days, 90 days or a year.
• Cost breakdown: ingestion against storage, and the cost by resource type and by connection and Region; each line opens the matching log groups.
• Daily cost: ingestion and storage per day.

#Recommendations

Each recommendation lists the log groups it applies to, why, what they store and what acting would save a month.

Screenshot

Delivery class log groups are left out. The potential saving counts each log group once, at its largest saving, and leaves out the Infrequent Access candidates (moving to that class means creating new log groups). Never expire, orphaned and stale log groups have Set retention per row and a button for the whole list.

#Changing retention in bulk

Team and above. Set retention (here, on the log group list, or from the what-if below) opens a dialog for many log groups at once.

Screenshot

• Choose the New retention. The dialog shows what is stored now, what remains after CloudWatch expires old events, and the estimated saving, per log group and in total.
• Log groups you can't change are listed as skipped, with the reason: a connection with the Read access level, no manage permission, or the Delivery class. Log groups that already have the chosen retention are left out.
• When any log group would keep events for less time than today, you confirm a second time: CloudWatch deletes the older events within a few days, and they can't be recovered.
• TraceHound changes up to 100 log groups per request, 5 at a time, and shows the result of each: Changed or Failed with the reason. Retry N failed tries the failed ones again.

Savings assume each log group's stored bytes are spread evenly over its age (or over its current retention, when that is shorter), at your storage price.

#Retention what-if

Retention what-if shows what a retention would save before you change anything: choose Log groups (a pattern such as /aws/lambda/* or words, empty for all), Which (only those that never expire, those keeping events longer than the new retention, or all that match) and the New retention. Review and apply opens the bulk dialog with those log groups.

Screenshot

#How costs are estimated

A log group's monthly cost is its last 30 days' ingestion times the ingestion price of its class (Standard, or Infrequent Access for Infrequent Access and Delivery log groups), plus its stored bytes times the storage price per GB-month. Ingestion is uncompressed bytes as CloudWatch meters them; stored bytes are compressed. The prices come from Administration › Settings (by default CloudWatch's us-east-1 list prices: $0.50 and $0.25 per GB ingested, $0.03 per GB-month stored); 1 GB is 2^30 bytes. The estimate leaves out the free tier, vended log volume tiers, data protection and other CloudWatch charges. Your AWS bill is the record.

#Explore

Explore searches the events of up to 50 log groups at once with CloudWatch Logs Insights, and charts them.

Screenshot

#Choose the log groups and the time

• Connection and Region, then Choose log groups: search the list, tick names, or type a prefix and choose Add pattern (for example /aws/lambda/orders-*). A pattern covers every matching log group you may read, including ones created later; the picker shows how many it matches. Pin selection keeps a set for later.
• Logs Insights reads at most 50 log groups per query: a selection that matches more is refused ("This selection matches N log groups. Logs Insights reads at most 50 at a time: narrow it, or use Trace, which runs in batches."). Use Trace to search more.
• Delivery class log groups can't be searched: Logs Insights can't query them, so patterns leave them out.
• The time picker offers quick ranges from the last 5 minutes to the last 30 days, or an absolute range (at most 366 days). Auto refresh (every 10 seconds to 5 minutes) runs relative ranges again while the tab is visible.

#Search

In Search mode, type what you are looking for and press Enter:

An empty search, or *, shows every event. TraceHound turns the search into a Logs Insights query (fields @timestamp, @message, @logStream, @log | filter ... | sort @timestamp desc | limit N); switch to Query to see and change it.

#Query

In Query mode, write a full query in Logs Insights QL, OpenSearch PPL or OpenSearch SQL. The editor completes commands, functions, fields and, in PPL and SQL, log group names, and marks the place of an error Logs Insights reports. Ctrl+Enter runs, Ctrl+S saves. Queries may be up to 10,000 characters.

• Choose log groups with the picker instead of the SOURCE command: TraceHound refuses SOURCE because it checks your access per log group.
• PPL and SQL queries may only name log groups that are in your selection.
• unmask doesn't work: TraceHound never has the logs:Unmask permission, so data masked by a data protection policy stays masked.
• Your AWS account runs at most 100 Logs Insights QL queries at once per Region (15 in PPL or SQL), shared with the console. When it is busy TraceHound says "CloudWatch Logs is busy: too many queries are running. Try again shortly." Your browser runs at most 4 queries at once.

#What a run shows and costs

Above the results, the run's status, records matched and scanned, bytes scanned, the estimated cost, the duration and the number of log groups. The cost is the bytes scanned times the Logs Insights price your administrator set ($0.005 per GB by default); a cancelled query is charged for what it had scanned. A search runs two queries, the events and the histogram, and more when you ask for them (facet counts, patterns, a chart); each is in your history with its cost.

More has Reuse results up to N minutes old: with it on, running exactly the same query over the same time again within that age (your administrator sets it, 5 minutes by default) shows your earlier run and scans nothing. Reuse only ever returns your own runs. More also sets how many Rows to return (100 to 10,000; 1,000 by default).

#Histogram and events

• The histogram counts the matching events over time by level (Fatal, Error, Warning, Info, Debug, Trace, No level). Drag across it, or choose a bar, to zoom into that time.
• The event list shows the time, the level, the log group and the message. JSON messages show their message and a few short fields. Expand a row for its JSON tree. Levels come from a level field, or from the message (ERROR, level=warn, "level":"info", Task timed out after, exceptions and so on).
• On any JSON value: + shows only events with that value, − hides them, col adds the field as a column (up to 20), copy copies it, and trace follows an id-like value in Trace.

#The event drawer

Choose an event to open the drawer: its log group and stream, the message as a JSON tree, every field, the identifiers found in it (X-Ray trace ids, request ids, UUIDs, id fields) with Follow in Trace and an X-Ray link, the AWS resources the log group belongs to, and Show 25 events before and after from the same stream. ↑ and ↓ move to the previous and next event.

Screenshot

#Facets

Facets shows, for the fields of the events on screen, how many have each value, instantly and for any field, however many values it has. Choose a value to filter on it, or − to exclude it; numeric fields show the minimum, average and maximum and accept a range. Count all matches counts a field's values over every match in the time range with one more query (stats count(*) by <field>). Add as column shows the field in the event list. Other fields of these log groups lists fields Logs Insights found in the last minutes of data that aren't on screen.

#Patterns

Patterns groups similar messages, so a few lines summarise thousands: each pattern with its number of events, share, severity, an example and a trend. Show events filters to a pattern; Hide excludes it.

Screenshot

Compare with the previous period runs the same patterns over the period just before and marks each pattern New, Gone, More, Fewer or Same, which is the quickest way to see what changed in an incident.

Screenshot

Patterns need a search, or a Logs Insights QL query without stats. They aren't available when the selection includes an Infrequent Access log group (CloudWatch doesn't run pattern and diff on them).

#Visualise

Visualise charts the result of a stats query as a time series, bar chart, pie chart, table or stat, or builds one for you from a search: Show (count, distinct count, average, sum, minimum, maximum, median, p90, p95, p99) of a field, Over time and Grouped by. Add to dashboard puts the chart on a new or existing dashboard.

Screenshot

#Save, share and export

• Save keeps the query as a saved query.
• Share copies a link to this exact view: the log groups, the search or query, the time range and the tab. Whoever opens it runs it with their own permissions.
• Export (needs export on every log group): All rows as CSV or JSON (the whole result, up to 10,000 rows, re-read from CloudWatch and recorded in the audit log), or the rows on screen as CSV, TSV, JSON or Markdown, or to the clipboard.
• More › Create a snapshot freezes the result (see Snapshots).

Logs Insights keeps results for 7 days; after that, run the query again.

#Trace

Trace follows one value, such as a request id, an X-Ray trace id or an order number, across any number of log groups, and lays the matching events out on a timeline with one lane per log group.

Screenshot

1. Paste the Value to follow. Join several values with OR (in capitals, up to 20).
2. Choose the log groups, with patterns such as /aws/lambda/*: there is no limit of 50 here.
3. Choose the time range and Trace.

TraceHound searches the log groups in batches of 50, at most four at a time, each batch one Logs Insights query (filter @message like "<value>", a case-sensitive match). The page shows each batch's progress and the bytes scanned and estimated cost of all of them. A trace always scans again: it never reuses earlier results.

• The summary shows the first and last time seen, the span, the log groups, events and errors.
• The swimlanes show each log group's events in time; errors are marked in red. Drag across the lanes to zoom, choose a tick to open the event.
• Identifiers found in these events lists the other ids in the matching events (X-Ray trace ids, request ids, UUIDs and id fields such as orderId), ranked by how many log groups they appear in. Follow adds one to this trace; New trace starts over with it.
• Open in X-Ray opens an X-Ray trace id in the CloudWatch console; Open in Explore searches the matching log groups (when there are at most 50).
• A batch can return at most 10,000 events; when one does, narrow the time range.

Permalink copies a link that runs the same trace.

#Live tail

Live tail follows up to 10 log groups as events arrive, through CloudWatch Logs Live Tail.

Screenshot

1. Choose the connection, the Region and up to 10 log groups (names, not patterns; read on each).
2. Optionally enter a Filter pattern (CloudWatch filter pattern syntax, for example ERROR or { $.level = "error" }) and Apply it, and Highlight terms.
3. Choose Start.

• Each line shows its time, log group (each in its own colour), level and message; expand it for the JSON tree, the stream and Open in Explore around this time. Choose a log group's chip to hide or show its lines.
• Pause holds new lines (up to 5,000) until you Resume; scrolling up stops auto-scroll. Clear empties the screen, and Download saves the lines as a text file.
• The status line shows the events per second and the session minutes this tail has used.
• Sampled: above 500 events a second, Live Tail sends only a sample; narrow the filter pattern to see every line.
• Shared sessions. CloudWatch bills Live Tail per session minute ($0.01 a minute at list price), so everyone who tails the same log groups with the same filter shares one session. The status then says Following a shared session (no extra cost). The session stops within a minute of the last viewer leaving.
• Streams renew about every 14 minutes, and after a dropped connection; the status shows Reconnecting… for a moment.
• Your administrator can set a daily limit of live tail minutes per person; once you reach it, new tails are refused for the rest of the UTC day.

Infrequent Access log groups can't be tailed (CloudWatch doesn't allow it), and neither can Delivery class log groups. Changing the log groups, the filter, the connection or the Region stops the tail; choose Start again.

#Dashboards

Dashboards lists Mine and Shared, by folder. A dashboard is a grid of panels, each a Logs Insights query and a visualisation, with variables and a time range.

#Templates

New from template opens ready-made dashboards for common AWS logs:

Screenshot

Choose Use this template, then the log groups it reads (names or patterns; the dashboard offers every match you may read as the variable $groups, and reads at most 50 at a time), a folder and who can see it. The dashboard is then yours to change. A log group's page opens the gallery with that log group filled in.

Screenshot

#Panels and layout

Screenshot

• Edit, then Add › Visualisation: choose the log groups the panel reads and write its query (Logs Insights, PPL or SQL), or pick a saved query (the panel then always runs that query's current text and log groups). Choose a visualisation, and the panel's Reuse results age and row limit (up to 10,000). Drag panels to move them and drag a corner to resize them on the 24-column grid. A dashboard has at most 60 panels.
• Add › Text panels show Markdown; Add › Row groups panels under a heading that can be collapsed.
• Repeat shows one copy of a panel per selected value of a variable.
• The panel menu has View, Inspect data (the rows, with CSV export for people with export), Inspect query (the rendered query and its statistics), Refresh and Explore.
• Time range: quick ranges or your own, such as now-6h to now, or now-7d/d (rounded down to the start of the day). Times are UTC. Zooming a time chart sets the dashboard's range.
• Auto refresh runs the panels again every 10 seconds to every day, but not faster than your plan allows: every 5 minutes on Starter, 1 minute on Team, 30 seconds on Business and 10 seconds on Enterprise. It pauses while the browser tab is hidden.
• Kiosk shows the dashboard full screen for a wall display; Esc leaves it.
• Share copies a link (or a link to this exact time), takes a snapshot, or exports the dashboard as JSON. Import JSON on the list creates a dashboard from such a file.
• Settings has the title, description, folder, tags, visibility, default time range and refresh, variables, the JSON model and Versions (restore an earlier version as the newest one).
• Private or shared as for saved queries (shared on Team and above). Your plan sets how many dashboards each person may own: 5 on Starter, 50 on Team, 500 on Business and unlimited on Enterprise.

Every panel runs with the permissions of the person viewing the dashboard: a shared dashboard shows each viewer only what their own grants allow, and a panel on log groups they can't read shows an error instead of data.

#How panels run

The browser runs at most 4 panels at once, so a large dashboard doesn't use up your account's Logs Insights capacity, and waits and tries again when CloudWatch is busy. Panels reuse your own earlier result of the same query for the reuse age your administrator set (5 minutes by default) unless the panel sets its own, and relative time ranges are rounded to the minute, so opening or refreshing a dashboard again soon scans nothing. Set a panel's reuse to 0 when it must read new data on every refresh.

#Variables

Variables add dropdowns or text boxes above a dashboard, whose values go into the panels' queries. A dashboard has at most 20.

Several values at once and Offer "All" are available for log groups, custom list and query variables. In a query, write:

The time range is not part of the query: it is the range every panel runs over, so don't filter on @timestamp for it. A typical panel:

filter service in [$service] and level = "ERROR"
| stats count(*) as errors by bin($__interval), service

Variables are filled in by your browser before the query runs, and the query then runs with your own permissions, exactly as if you had typed the values. A variable never grants access to anything.

#Visualisations

TraceHound suggests a visualisation from the result: log lines become a log list, a time column with numbers a time series, one row of numbers a stat, a text column with numbers a bar chart. Every type has units (number, short, count, bytes, percent, milliseconds, seconds, US dollars), decimals, minimum and maximum, colours by series or thresholds, and a legend and tooltip where they apply.

#Saved queries

Save a query from Explore with Save (Ctrl+S). A saved query keeps its name, a description, a folder, tags, its log groups, its language and query, its time range, its variables and up to 10 visualisations.

Screenshot

Queries lists Mine and Shared.

• Folders and tags. Put a query in a folder (a path such as Checkout/Errors) and give it up to 20 tags, then filter the list by folder, tag or text.
• Private or shared. A private query is visible to you and administrators. A shared query (Team and above) is visible to everyone signed in. Sharing a query shares its text and log groups, never your permissions or your results: whoever runs it needs their own read on its log groups. Only the owner or an administrator can change or delete it; others can Duplicate it.
• Last run. Each saved query shows its last run: status, time, bytes scanned and duration.
• Versions. Every save keeps the previous content as a version: the latest 5 on Starter, 25 on Team, 50 on Business and 100 on Enterprise. Versions lists them, Compare shows the differences and Restore saves an old version as the newest one.
• Conflicts. If someone else saved the query after you opened it, TraceHound asks before overwriting their change (theirs stays in the versions), or saves yours as a copy.

Your plan sets how many saved queries each person may own: 50 on Starter, 500 on Team, 2,000 on Business and unlimited on Enterprise.

#History

History lists the Logs Insights queries you ran through TraceHound, newest first, from Explore, saved queries, dashboards, Trace, patterns, histograms, facets and dashboard variables. Filter by Status and Source, or by text. Each entry shows the time, the log groups and query, the status, the duration, the bytes scanned and the estimated cost; Open shows it in Explore and Run again runs it again.

Screenshot

History is kept for your plan's history days: 30 on Starter, 90 on Team, 365 on Business and 730 on Enterprise, across every log group, Region and account. It covers queries started through TraceHound only, not those from the CloudWatch console or other tools. Logs Insights keeps results for 7 days, so older entries show the query and its statistics but no rows.

Administrators also see Everyone: every query run through TraceHound on a chosen day (UTC), with who ran it.

#Snapshots

Team and above. A snapshot is a frozen copy of a result, or of a whole dashboard with the results of its panels, that you can send as a link. Use it to share what you found, for example in a post-incident review, with someone who can't run the query themselves.

A snapshot is readable by everyone signed in to TraceHound, whether or not they have grants on its log groups. Creating one shares that data with your whole organisation, and TraceHound asks you to confirm before it does.

Screenshot

• From a result: More › Create a snapshot in Explore, after a successful run of your own. You need export on every log group of the query.
• From a dashboard: Share › Snapshot…. It copies the dashboard as it is now, with its time range and variable values, and the results of every panel that finished. Each panel's result must come from your own run, with export on its log groups.
• Give it a title, an optional description and how many days it should last (up to the maximum your administrator set, 30 days by default). It expires on its own after that.
• TraceHound copies the rows itself: up to 10,000 rows in total on Team, 50,000 on Business and 100,000 on Enterprise.

Snapshots lists the snapshots you created, with their expiry; open one to copy its link, or Delete it at any time. Administrators can see and delete everyone's. Every snapshot created or deleted is recorded in the audit log. Viewers still need to sign in, and your organisation's IP allowlist applies to them.

#When something is refused