Sherlock 🔍
CLI tool for extracting AWS CloudWatch Logs locally.
Installation
From PyPI
pip install aws-sherlock
Configuration
Make sure you have AWS credentials configured.
Required permissions:
logs:FilterLogEventslogs:DescribeLogGroups
Usage
sherlock --log-group "my-log-group" --start "2025-09-10T12:00:00Z" --end "2025-09-10T12:15:00Z" --region "eu-central-1" --filter-pattern "UnwantedException"
Options
| Option | Description | Required | Default |
|---|---|---|---|
--log-group |
CloudWatch Log Group name | Yes | - |
--start-time |
Start time for filtering (ISO8601 format) | Yes | - |
--end-time |
End time for filtering (ISO8601 format) | Yes | - |
--region |
End time for filtering (ISO8601 format) | Yes | - |
--filter-pattern |
CloudWatch filter pattern | No | "" |
--output |
Output file name | No | logs.txt |
Time Format
Time parameters (--start-time and --end-time) must be in ISO8601 format:
2025-09-10T14:30:00Z(UTC timezone)2025-09-10T14:30:00+02:00(with timezone offset)2025-09-10T14:30:00.123Z(with milliseconds)
Output Format
The exported logs include the following columns:
- Timestamp - Original timestamp in milliseconds
- Date - Human-readable date (YYYY-MM-DD HH:MM:SS)
- Log Stream - CloudWatch log stream name
- Message - The actual log message
Example output:
1757506004044 2025-09-10 14:06:44 my-log-group/3cb6c84259584af3be92688fc6f809eb ERROR: Application failure occurred
License
This project is licensed under the MIT License - see the LICENSE file for details.
Author
Eric Villa - eric.villa91@gmail.com
1 maintainer
Metadata
1 maintainer
Release files for aws-sherlock 0.1.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| aws_sherlock-0.1.4.tar.gz | 3.7 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| aws_sherlock-0.1.4-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 9.2 kB
Release files / aws_sherlock-0.1.4.tar.gz
| Download URL | aws_sherlock-0.1.4.tar.gz |
|---|---|
| Size | 3.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
a55741144d99f489b2066b422c05fdda984e9712b9a762f4fc4430bd97b1de0c
|
|
BLAKE2b-256 checksum How to use checksums |
9ffcb39922124773009f8d96680aa76f2dd0ac3e2bae9b636fd64868b7aa39b7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
poetry/2.1.3 CPython/3.13.5 Darwin/24.4.0
|
Release files / aws_sherlock-0.1.4-py3-none-any.whl
| Download URL | aws_sherlock-0.1.4-py3-none-any.whl |
|---|---|
| Size | 5.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
7fbdaa1c3831fb563daf51c9c57cd8c89b5947e0d8b8051ae75fb9ff3afc4aa0
|
|
BLAKE2b-256 checksum How to use checksums |
f02b8ce608d9fba4cff8aa5cf1ebded7c60b52dfe2c5a60c2f8c03477bd92332
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
poetry/2.1.3 CPython/3.13.5 Darwin/24.4.0
|
Security for aws-sherlock 0.1.4
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
