title: How do I filter and extract raw log event data from Amazon Cloudwatch
body: <p>Is there any way to 1) filter and 2) retrieve the raw log data out of Cloudwatch via the API or from the CLI? I need to extract a subset of log events from Cloudwatch for analysis.</p>
  
  <p>I don't need to create a metric or anything like that. This is for historical research of a specific event in time.</p>
  
  <p>I have gone to the log viewer in the console but I am trying to pull out specific lines to tell me a story around a certain time. The log viewer would be nigh-impossible to use for this purpose. If I had the actual log file, I would just grep and be done in about 3 seconds. But I don't.</p>
  
  <p><strong>Clarification</strong></p>
  
  <p>In the description of <a href="http://aws.amazon.com/about-aws/whats-new/2014/07/10/introducing-amazon-cloudwatch-logs/" rel="noreferrer">Cloudwatch Logs</a>, it says, "You can view the original log data <em>(only in the web view?)</em> to see the source of the problem if needed. Log data can be stored and accessed <em>(only in the web view?)</em> for as long as you need using highly durable, low-cost storage so you don’t have to worry about filling up hard drives." --italics are mine</p>
  
  <p>If this console view is the only way to get at the source data, then storing logs via Cloudwatch is not an acceptable solution for my purposes. I need to get at the actual data with sufficient flexibility to search for patterns, not click through dozens of pages lines and copy/paste. It appears a better way to get to the source data may not be available however.</p>