Amazon CloudWatch Logs

Create log groups and streams, write events and read or filter the stored messages.

Plan: Free112 of 118 operations implemented2Known differences

The tested Logs Insights query returned Complete with empty results despite a matching stored event.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

Connect

This Free service needs no license key. Start Vera as in Get started, then run this in a terminal of its own, from an empty scratch directory. It gives the official AWS CLI dummy credentials and a config file of its own, so no AWS account is needed and your own AWS profile isn't touched.

export VERA_ENDPOINT="http://localhost:5003"
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_REGION=us-east-1 AWS_DEFAULT_REGION=us-east-1
export AWS_SHARED_CREDENTIALS_FILE=/dev/null
export AWS_EC2_METADATA_DISABLED=true
export AWS_PAGER="" AWS_CLI_AUTO_PROMPT=off
unset AWS_PROFILE AWS_DEFAULT_PROFILE
unset AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
unset AWS_WEB_IDENTITY_TOKEN_FILE AWS_ROLE_ARN AWS_ROLE_SESSION_NAME
unset AWS_CONTAINER_CREDENTIALS_FULL_URI
unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
cat > vera-aws-config <<'EOF'
[default]
region = us-east-1
output = json
cli_binary_format = base64
s3 =
    addressing_style = path
EOF
export AWS_CONFIG_FILE="$PWD/vera-aws-config"

When you've finished every example in this terminal, close it and delete vera-aws-config, not before.

Use the AWS CLI’s logs commands. The emulator serves the 2014-03-28 API over the AWS JSON protocol. Metric alarms and metric data are a separate service: see CloudWatch.

Example

Create a log group with a retention policy and a stream, write an event to it, then read it back and find it with a filter pattern. The event is stamped with the current time in milliseconds, worked out with POSIX date +%s arithmetic, so a fixed timestamp can’t go out of date.

aws --endpoint-url "$VERA_ENDPOINT" logs create-log-group --log-group-name /vera-docs/audit
aws --endpoint-url "$VERA_ENDPOINT" logs put-retention-policy \
  --log-group-name /vera-docs/audit --retention-in-days 7
aws --endpoint-url "$VERA_ENDPOINT" logs create-log-stream \
  --log-group-name /vera-docs/audit --log-stream-name docs-stream
aws --endpoint-url "$VERA_ENDPOINT" logs put-log-events \
  --log-group-name /vera-docs/audit --log-stream-name docs-stream \
  --log-events "[{\"timestamp\": $(($(date +%s) * 1000)), \"message\": \"hello from example.net\"}]"
aws --endpoint-url "$VERA_ENDPOINT" logs get-log-events \
  --log-group-name /vera-docs/audit --log-stream-name docs-stream --start-from-head
aws --endpoint-url "$VERA_ENDPOINT" logs filter-log-events \
  --log-group-name /vera-docs/audit --filter-pattern example.net

get-log-events returns the event with its message and timestamp, and the filter finds it too. This is the filter’s output. These are selected fields; the times and eventId differ on every run.

{
    "events": [
        {
            "logStreamName": "docs-stream",
            "timestamp": 1793911046000,
            "message": "hello from example.net",
            "ingestionTime": 1793911052965,
            "eventId": "log_event-32b15a5730354980a"
        }
    ],
    "searchedLogStreams": []
}

A filter pattern that matched nothing in the group returned no events.

To clean up, delete the log group:

aws --endpoint-url "$VERA_ENDPOINT" logs delete-log-group --log-group-name /vera-docs/audit

Supported features

Log groups, created and deleted, with a retention policy accepted. In earlier recorded comparisons, the CreateLogGroup, PutRetentionPolicy and DeleteLogGroup responses matched AWS’s.
Log streams and events: an event’s message and millisecond timestamp come back from GetLogEvents.
Simple filtering: FilterLogEvents found the event by a plain-text pattern, and a pattern that didn’t match returned nothing. Other filter syntax wasn’t checked.
Also served, not checked in Vera 1.2.0 preview or Vera 1.2.0-rc.3: scheduled queries, metric and subscription filters, destinations and deliveries, export and import tasks, anomaly detectors, data protection, account and resource policies, transformers, live tail and tags.

Limitations

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

Logs Insights didn’t evaluate the tested query. In Vera 1.2.0 preview, after an event with the message hello from docs was written, StartQuery with fields @timestamp, @message | limit 20 and a time range covering the event succeeded. GetQueryResults then reported Complete at once, with results empty and recordsMatched and recordsScanned both 0. A check on Vera 1.2.0-rc.3 still returned an empty query result.
Only storage, retrieval and simple filtering were tested. Subscription delivery, metric filters, export and import, and live tail weren’t. A stored subscription or destination doesn’t mean logs are delivered anywhere.
Retention wasn’t tested. A retention policy is stored, but whether events expire after it wasn’t checked, nor limits on event size and ordering.

API coverage

Every operation in AWS's published 2014-03-28 API (SDK model, botocore 1.43.105), and whether the emulator implements it. Availability combines the earlier implementation inventory with the dated observations below; checking a page's example does not verify every operation. Each note names its evidence first; an observation given without a build or date comes from earlier testing, on 3 November 2026. What the statuses mean

Operation	Status	Notes
AssociateKmsKey	Implemented
AssociateSourceToS3TableIntegration	Implemented
CancelExportTask	Implemented
CancelImportTask	Implemented
CreateDelivery	Implemented
CreateExportTask	Implemented
CreateImportTask	Implemented
CreateLogAnomalyDetector	Implemented
CreateLogGroup	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — Created the example's log group.
CreateLogStream	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — Created the example's log stream.
CreateLookupTable	Implemented
CreateScheduledQuery	Implemented
DeleteAccountPolicy	Implemented
DeleteDataProtectionPolicy	Implemented
DeleteDelivery	Implemented
DeleteDeliveryDestination	Implemented
DeleteDeliveryDestinationPolicy	Implemented
DeleteDeliverySource	Implemented
DeleteDestination	Implemented
DeleteIndexPolicy	Implemented
DeleteIntegration	Implemented
DeleteLogAnomalyDetector	Implemented
DeleteLogGroup	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — Deleted the example's log group.
DeleteLogStream	Implemented
DeleteLookupTable	Implemented
DeleteMetricFilter	Implemented
DeleteQueryDefinition	Implemented
DeleteResourcePolicy	Implemented
DeleteRetentionPolicy	Implemented
DeleteScheduledQuery	Implemented
DeleteSubscriptionFilter	Implemented
DeleteSyslogConfiguration	Not implemented
DeleteTransformer	Implemented
DescribeAccountPolicies	Implemented
DescribeConfigurationTemplates	Implemented
DescribeDeliveries	Implemented
DescribeDeliveryDestinations	Implemented
DescribeDeliverySources	Implemented
DescribeDestinations	Implemented
DescribeExportTasks	Implemented
DescribeFieldIndexes	Implemented
DescribeImportTaskBatches	Implemented
DescribeImportTasks	Implemented
DescribeIndexPolicies	Implemented
DescribeLogGroups	Implemented
DescribeLogStreams	Implemented
DescribeLookupTables	Implemented
DescribeMetricFilters	Implemented
DescribeQueries	Implemented
DescribeQueryDefinitions	Implemented
DescribeResourcePolicies	Implemented
DescribeSubscriptionFilters	Implemented
DisassociateKmsKey	Implemented
DisassociateSourceFromS3TableIntegration	Implemented
FilterLogEvents	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — A plain-text pattern found the stored event, and a pattern that didn't match returned no events. Other filter syntax wasn't checked.
GetDataProtectionPolicy	Implemented
GetDelivery	Implemented
GetDeliveryDestination	Implemented
GetDeliveryDestinationPolicy	Implemented
GetDeliverySource	Implemented
GetIntegration	Implemented
GetLogAnomalyDetector	Implemented
GetLogEvents	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — Returned the stored event's message and timestamp.
GetLogFields	Implemented
GetLogGroupFields	Implemented
GetLogObject	Implemented
GetLogRecord	Implemented
GetLookupTable	Implemented
GetQueryResults	Known difference	Local observation: Vera 1.2.0 preview, 5 November 2026 — For the tested query, reported status `Complete` at once, with `results` `[]`, `recordsMatched` `0` and `recordsScanned` `0`, although a matching event was stored. This is not a working Logs Insights evaluation for the tested case.
GetScheduledQuery	Implemented
GetScheduledQueryHistory	Implemented
GetStorageTierPolicy	Not implemented
GetTransformer	Implemented
ListAggregateLogGroupSummaries	Not implemented
ListAnomalies	Implemented
ListIntegrations	Implemented
ListLogAnomalyDetectors	Implemented
ListLogGroups	Implemented
ListLogGroupsForQuery	Implemented
ListScheduledQueries	Implemented
ListSourcesForS3TableIntegration	Implemented
ListSyslogConfigurations	Not implemented
ListTagsForResource	Implemented
ListTagsLogGroup	Implemented
PutAccountPolicy	Implemented
PutBearerTokenAuthentication	Implemented
PutDataProtectionPolicy	Implemented
PutDeliveryDestination	Implemented
PutDeliveryDestinationPolicy	Implemented
PutDeliverySource	Implemented
PutDestination	Implemented
PutDestinationPolicy	Implemented
PutIndexPolicy	Implemented
PutIntegration	Implemented
PutLogEvents	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — Stored an event stamped with the current time in milliseconds.
PutLogGroupDeletionProtection	Implemented
PutMetricFilter	Implemented
PutQueryDefinition	Implemented
PutResourcePolicy	Implemented
PutRetentionPolicy	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — Accepted a 7-day retention policy. Expiry wasn't checked.
PutStorageTierPolicy	Not implemented
PutSubscriptionFilter	Implemented
PutSyslogConfiguration	Not implemented
PutTransformer	Implemented
StartLiveTail	Implemented
StartQuery	Known difference	Local observation: Vera 1.2.0 preview, 5 November 2026 — After an event with the message `hello from docs` was written, `StartQuery` with `fields @timestamp, @message \| limit 20` and a time range covering the event succeeded, but the query was not evaluated: see `GetQueryResults`.
StopQuery	Implemented
TagLogGroup	Implemented
TagResource	Implemented
TestMetricFilter	Implemented
TestTransformer	Implemented
UntagLogGroup	Implemented
UntagResource	Implemented
UpdateAnomaly	Implemented
UpdateDeliveryConfiguration	Implemented
UpdateLogAnomalyDetector	Implemented
UpdateLookupTable	Implemented
UpdateScheduledQuery	Implemented