How do I export and analyze my CloudWatch alarm history that's older than two weeks?

Short description

CloudWatch alarms have a 14 day history. After this time period, the history is removed from the console. To check your alarm history that's older than two weeks, use Amazon EventBridge. Create a rule that captures and sends the alarm state change events to the CloudWatch log group.

Resolution

To use EventBridge to check history that's older than two weeks, complete the following steps:

1. Open the EventBridge console.
2. Choose Create rule, and then create a name for the rule.
3. In the Event source field, select AWS events or EventBridge partner events.
4. In the Event pattern field, select the following:
   For Event source, select AWS services.
   For AWS service, select CloudWatch.
   For Event type, select CloudWatch Alarm State Change.
5. Select your required CloudWatch log group as the target, and then save the event rule.

When your CloudWatch alarm state changes, the EventBridge rule captures the event and creates a CloudWatch log event. To analyze your log data, see Analyzing log data with CloudWatch Logs Insights.

Related information

CloudWatch Logs Insights query syntax

Extending and exploring alarm history in Amazon CloudWatch - part 1