Gonzo: A Better Way to Tail AWS CloudWatch Logs

Cloud-native teams rely heavily on logs for debugging, auditing, and observability. In a previous blog, we showed how Gonzo can combine application logs with Kubernetes control plane logs for a unified troubleshooting experience. Now, we’re extending that approach to include cloud provider infrastructure logs—specifically AWS CloudWatch Logs.

This lets you bring together Kubernetes, application, and AWS infrastructure/serverless logs in the same Gonzo view, so you can trace issues across every layer of your stack.

Why Use Gonzo with AWS CloudWatch?

While the AWS CLI provides built-in commands (logs tail, start-live-tail) to stream logs, practitioners quickly run into limitations:

• Timestamps are shown only in UTC; you can’t easily reformat them to your local time zone.
• Log group filters are limited—you can only filter by prefix, not by arbitrary substrings within log stream names.
• One log group at a time: tailing multiple groups requires juggling separate processes.

Gonzo solves these pain points by:

• Normalizing timestamps into your local context.
• Allowing flexible filtering, search, and AI-powered summarization on log streams.
• Supporting unified views across multiple log groups—including those from Kubernetes, Lambda, RDS, or even CloudTrail (if forwarded into CloudWatch).

This means you can troubleshoot cross-cutting issues—say, a failed API request traced from CloudTrail into an EKS cluster and down into a single container log—all in one Gonzo session.

Prerequisites

Install AWS CLI

Follow the AWS CLI installation guide.

List Your Log Groups

Use this to discover available log groups in your configured AWS region:

aws logs describe-log-groups \
  --query 'logGroups[*].{Name:logGroupName,ARN:arn}' \
  --output json

aws logs describe-log-groups \
  --query 'logGroups[*].{Name:logGroupName,ARN:arn}' \
  --output json

Using AWS CLI Tail with Gonzo

The simplest usage is piping aws logs tail output into Gonzo:

aws logs tail "/aws/eks/stage/cluster" --follow | gonzo

aws logs tail "/aws/eks/stage/cluster" --follow | gonzo

For JSON-formatted logs with richer attributes visible in Gonzo:

aws logs tail "/aws/eks/stage/cluster" --follow --format json | gonzo

aws logs tail "/aws/eks/stage/cluster" --follow --format json | gonzo

Multiple Log Groups

You can merge several log groups into a single Gonzo session:

gonzo - < <(
  aws logs tail "/aws/eks/stage/cluster" --follow --format json &
  aws logs tail "RDS" --follow --format json &
  wait
)

gonzo - < <(
  aws logs tail "/aws/eks/stage/cluster" --follow --format json &
  aws logs tail "RDS" --follow --format json &
  wait
)

Using AWS CLI Live Tail with Gonzo

AWS Live Tail streams logs as they are ingested. Gonzo can consume this directly:

aws logs start-live-tail \
  --log-group-identifiers "arn:aws:logs:us-east-1:123456789012:log-group:/aws/eks/stage/cluster" \
  "arn:aws:logs:us-east-1:123456789012:log-group:RDS" \
  | gonzo

aws logs start-live-tail \
  --log-group-identifiers "arn:aws:logs:us-east-1:123456789012:log-group:/aws/eks/stage/cluster" \
  "arn:aws:logs:us-east-1:123456789012:log-group:RDS" \
  | gonzo

Because Live Tail outputs JSON by default, Gonzo captures structured log attributes seamlessly.

Check out the full usage guide for Gonzo with AWS CloudWatch logs tail and live tail here.

Cost Considerations

Note: AWS charges for data retrieval and streaming via tail and start-live-tail. Check the CloudWatch pricing page to estimate your usage costs.

Conclusion

By pairing AWS CloudWatch Logs with Gonzo, you gain a powerful, developer-friendly way to explore infrastructure, serverless, and application logs in one place. This is especially useful for:

• Debugging cross-service issues across Kubernetes and AWS managed services.
• Analyzing security/audit events (via CloudTrail in CloudWatch).
• Replacing standard aws logs tail workflows with something faster and more flexible.

If you’re already using Gonzo for Kubernetes and application logs, extending to AWS CloudWatch gives you a truly end-to-end observability surface in your terminal.

Back

Share