How do I export and analyze my CloudWatch alarm history that's older than two weeks?

Short description

CloudWatch alarms preserve history for 30 days. After 30 days, CloudWatch removes the history from the console. To check your alarm history that's older than 30 days, use Amazon EventBridge. Then, create a rule that captures and sends changes about alarm state events to the CloudWatch log group.

Resolution

To use EventBridge to check history that's older than two weeks, complete the following steps:

1. Open the EventBridge console.
2. Choose Create rule, and then enter a name for the rule.
3. Choose Next.
4. For Event source, select AWS events or EventBridge partner events.
5. Under Event pattern, choose the following options:
   For Event source, select AWS services.
   For AWS service, select CloudWatch.
   For Event type, select CloudWatch Alarm State Change.
6. Choose Next.
7. Under Select a target, choose CloudWatch log group.
8. For Log Group, choose Existing log group, and then select your CloudWatch log group.
9. Choose Skip to Review and create, and then choose Create rule.

When your CloudWatch alarm state changes, the EventBridge rule captures the event and creates a CloudWatch log event. To analyze your log data, see Analyzing log data with CloudWatch Logs Insights.

Related information

CloudWatch Logs Insights language query syntax

Extending and exploring alarm history in Amazon CloudWatch - part 1