# 使用CloudWatch Logs Insights检索日志

你可以使用CloudWatch Logs Insights来搜索过去90天以外的API历史。您必须创建并配置一个trail，以记录到Amazon CloudWatch Logs。欲了解更多信息，请参阅[Creating a trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html)。

1\.    打开[CloudWatch console](https://console.aws.amazon.com/cloudwatch/).

2\.    选择 **Logs**.

3\.    在 **Log Groups，**&#x9009;择你的日志组。

4\.    选择 **Search Log Group**.

5\.    在 **Filter events，** 输入检索条件，然后，选择更新按钮。

## 检索样例

### 1. 查找某个user的所有API请求

用你要搜索的用户名替换Alice。对于使用IAM role进行的请求，userName字段的值不是role名称。

```
{ $.userIdentity.userName = "Alice" }
```

### 2. 查找某个user的某个API请求

下面的语句查找 [DescribeInstances](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html) API 请求。可以替换成自己想要查找的API action。

```
{ ($.eventName = "DescribeInstances") && ($.requestParameters.userName = "Alice"  ) }
```

## 相关资料

[How do I use AWS CloudTrail to track API calls to my Amazon EC2 instances?](https://repost.aws/knowledge-center/cloudtrail-search-api-calls)

[How do I use CloudTrail to see if a security group or resource was changed in my AWS account?](https://repost.aws/knowledge-center/cloudtrail-event-history-changed)

[How can I use CloudTrail to review what API calls and actions have occurred in my AWS account?](https://repost.aws/knowledge-center/cloudtrail-track-api)
