[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-agentcore-investigation":3,"mdc--uggb5m-key":45,"related-repo-aws-labs-agentcore-investigation":1011,"related-org-aws-labs-agentcore-investigation":1098},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":40,"sourceUrl":43,"mdContent":44},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,17,20,23],{"name":14,"slug":15,"type":16},"Observability","observability","tag",{"name":18,"slug":19,"type":16},"Logs","logs",{"name":21,"slug":22,"type":16},"AWS","aws",{"name":24,"slug":25,"type":16},"Debugging","debugging",9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",null,1634,[22,32,33,34,35,36,37,38,39],"mcp","mcp-client","mcp-clients","mcp-host","mcp-server","mcp-servers","mcp-tools","modelcontextprotocol",{"repoUrl":27,"stars":26,"forks":30,"topics":41,"description":42},[22,32,33,34,35,36,37,38,39],"Open source MCP Servers for AWS","https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp\u002Ftree\u002FHEAD\u002Fsrc\u002Fcloudwatch-mcp-server\u002Fskills\u002Fagentcore-investigation","---\nname: agentcore-investigation\ndescription: Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.\n---\n\n# AgentCore Runtime Session Investigation\n\nInvestigate AgentCore runtime sessions by querying CloudWatch Logs Insights, filtering OpenTelemetry noise, and producing structured investigation output.\n\n**Key capabilities:**\n- Session-to-trace resolution via OTEL span correlation\n- Structured and glob-style parse queries for both dedicated and combined log groups\n- OpenTelemetry noise filtering with AgentCore-specific heuristics\n- Timeline construction with T+offset format\n- Error, tool invocation, token usage, and latency analysis\n\n---\n\n## Reference Files\n\nLoad these files as needed for detailed guidance:\n\n### MCP:\n#### [mcp-setup.md](mcp\u002Fmcp-setup.md)\n**When:** ALWAYS load before starting an investigation — ensures CloudWatch and Application Signals MCP servers are configured\n**Contains:** MCP server configuration for CloudWatch Logs and Application Signals, with setup instructions for Claude Code, Gemini, Codex, and Kiro CLI\n\n#### [.mcp.json](mcp\u002F.mcp.json)\n**When:** Load when setting up MCP servers for the first time\n**Contains:** Sample MCP configuration with both CloudWatch and Application Signals servers\n\n### [otel-span-schema.md](references\u002Fotel-span-schema.md)\n**When:** ALWAYS load before querying or filtering OTEL spans\n**Contains:** Field extraction priorities, known instrumentation scopes, noise filtering heuristics (DROP\u002FKEEP patterns)\n\n---\n\n## Phase 0: SessionId-to-TraceId Resolution\n\nWhen the user provides a sessionId, resolve it to traceId(s) first. If user provides traceId directly, skip this phase.\n\n### Discovery Query (structured fields)\n\n```\nfields traceId, @timestamp\n| filter attributes.session.id = \"SESSION_ID\"\n| stats count(*) as spanCount, min(@timestamp) as firstSeen, max(@timestamp) as lastSeen by traceId\n| sort firstSeen asc\n```\n\n### Discovery Query (combined log group — glob-style parse)\n\n```\nfields @timestamp, @message\n| parse @message '\"traceId\":\"*\"' as traceId\n| parse @message '\"session.id\":\"*\"' as sessionId\n| filter sessionId = \"SESSION_ID\" or @message like \"SESSION_ID\"\n| stats earliest(@timestamp) as firstSeen, latest(@timestamp) as lastSeen, count(*) as spanCount by traceId\n| sort firstSeen asc\n| limit 50\n```\n\n### Latest Interaction Only\n\n```\nfields traceId\n| filter attributes.session.id = \"SESSION_ID\"\n| sort @timestamp desc\n| limit 1\n```\n\nStore discovered traceId(s) and use them in ALL subsequent queries.\n\n## Phase 1: Discover Log Groups\n\nUse `describe_log_groups` with logGroupNamePrefix `\u002Faws\u002Fbedrock-agentcore\u002Fruntimes` to find all runtime log groups.\n\n```\nLog group naming patterns (in priority order):\n- \u002Faws\u002Fbedrock-agentcore\u002Fruntimes\u002F\u003Cagent_id>-\u003Cendpoint_name>\u002Fotel-rt-logs (structured OTEL spans)\n- \u002Faws\u002Fbedrock-agentcore\u002Fruntimes\u002F\u003Cagent_id>-\u003Cendpoint_name>\u002F[runtime-logs] (stdout\u002Fstderr)\n- \u002Faws\u002Fbedrock-agentcore\u002Fruntimes\u002F\u003Cagent_id>-\u003Cendpoint_name>-DEFAULT (single combined group)\n```\n\n### Log Group Layouts\n\nAgentCore runtimes always emit OTEL spans. Some deployments split logs into a dedicated `otel-rt-logs` sub-group; others write everything into a single combined log group. Both are normal.\n\n| Log Group Layout | Query Strategy |\n|-----------------|----------------|\n| Dedicated `otel-rt-logs` exists | Use structured field queries (`traceId`, `attributes.session.id`, etc.) |\n| Single combined log group | Try structured fields first — if they return 0 results, use glob-style `parse @message` |\n\nIf a dedicated `otel-rt-logs` group exists, prefer it for structured queries.\n\n### Parse Syntax Guidance\n\nWhen using `parse @message` on combined log groups, prefer glob-style parse — it is simpler and avoids escaping issues:\n\n```\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"traceId\":\"*\"' as traceId\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n```\n\nRegex parse (`\u002Fpattern\u002F`) is valid CloudWatch Logs Insights syntax but requires careful escaping of quotes and special characters inside JSON. If glob-style parse extracts the field you need, use it.\n\n## Phase 2: Query CloudWatch Logs Insights\n\nRun all 6 query types for a complete investigation. Each query has a structured version (for dedicated `otel-rt-logs`) and a glob-style parse version (for combined log groups).\n\n### Query Size Limits\n\nEvery query MUST include `| limit` to prevent context window overflow:\n- Session overview: `| limit 50`\n- Span details: `| limit 100`\n- Errors: `| limit 50`\n- Tool invocations: `| limit 100`\n- Token usage: `| limit 50`\n- Latency outliers: `| limit 20`\n\n### Query 1: Session Overview\n\n**Structured:**\n```\nfields @timestamp, traceId, spanId, parentSpanId, name, scope.name,\n       attributes.session.id, attributes.gen_ai.operation.name, attributes.gen_ai.agent.name,\n       startTimeUnixNano, endTimeUnixNano\n| filter traceId = \"TRACE_ID\"\n| sort startTimeUnixNano asc\n| limit 50\n```\n\n**Combined log group:**\n```\nfields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"traceId\":\"*\"' as traceId\n| parse @message '\"spanId\":\"*\"' as spanId\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n| parse @message '\"endTimeUnixNano\":\"*\"' as endNano\n| sort @timestamp asc\n| limit 50\n```\n\n### Query 2: Span Details with Duration\n\n**Structured:**\n```\nfields @timestamp, traceId, spanId, parentSpanId, name, scope.name,\n       startTimeUnixNano, endTimeUnixNano,\n       (endTimeUnixNano - startTimeUnixNano) \u002F 1000000 as durationMs,\n       status.code, attributes.gen_ai.operation.name\n| filter traceId = \"TRACE_ID\"\n| filter ispresent(startTimeUnixNano)\n| sort startTimeUnixNano asc\n| limit 100\n```\n\n**Combined log group:**\n```\nfields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"spanId\":\"*\"' as spanId\n| parse @message '\"parentSpanId\":\"*\"' as parentSpanId\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n| parse @message '\"endTimeUnixNano\":\"*\"' as endNano\n| parse @message '\"statusCode\":\"*\"' as statusCode\n| sort @timestamp asc\n| limit 100\n```\n\n### Query 3: Errors\n\n**Structured:**\n```\nfields @timestamp, traceId, spanId, name, status.code, status.message,\n       attributes.error.message, attributes.exception.message, attributes.exception.type\n| filter traceId = \"TRACE_ID\"\n| filter status.code = 2 OR ispresent(attributes.error.message) OR ispresent(attributes.exception.message)\n| sort @timestamp asc\n| limit 50\n```\n\n**Combined log group:**\n```\nfields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| filter @message like \u002FERROR|exception|Exception|fault|STATUS_CODE_ERROR\u002F\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"statusCode\":\"*\"' as statusCode\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n| sort @timestamp asc\n| limit 50\n```\n\n### Query 4: Tool Invocations\n\n**Structured:**\n```\nfields @timestamp, traceId, spanId, name, scope.name,\n       attributes.gen_ai.operation.name, attributes.tool.name,\n       startTimeUnixNano, endTimeUnixNano,\n       (endTimeUnixNano - startTimeUnixNano) \u002F 1000000 as durationMs\n| filter traceId = \"TRACE_ID\"\n| filter attributes.gen_ai.operation.name = \"execute_tool\" OR ispresent(attributes.tool.name) OR name like \u002Ftool\u002F\n| sort startTimeUnixNano asc\n| limit 100\n```\n\n**Combined log group:**\n```\nfields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| filter @message like \u002Ftool|execute_tool|function_call\u002F\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n| parse @message '\"endTimeUnixNano\":\"*\"' as endNano\n| parse @message '\"statusCode\":\"*\"' as statusCode\n| sort @timestamp asc\n| limit 100\n```\n\n### Query 5: Token Usage\n\n**Structured:**\n```\nfields @timestamp, traceId, spanId, name,\n       attributes.gen_ai.usage.input_tokens, attributes.gen_ai.usage.output_tokens,\n       attributes.gen_ai.usage.total_tokens, attributes.gen_ai.agent.name\n| filter traceId = \"TRACE_ID\"\n| filter ispresent(attributes.gen_ai.usage.total_tokens)\n| sort @timestamp asc\n| limit 50\n```\n\n**Combined log group:**\n```\nfields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| filter @message like \u002Finput_tokens|output_tokens|usage\u002F\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"gen_ai.usage.input_tokens\"' as hasTokens\n| sort @timestamp asc\n| limit 50\n```\n\n### Query 6: Latency Outliers\n\n**Structured:**\n```\nfields @timestamp, traceId, spanId, name,\n       (endTimeUnixNano - startTimeUnixNano) \u002F 1000000 as durationMs\n| filter traceId = \"TRACE_ID\"\n| filter ispresent(endTimeUnixNano)\n| sort durationMs desc\n| limit 20\n```\n\n**Combined log group:**\n```\nfields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n| parse @message '\"endTimeUnixNano\":\"*\"' as endNano\n| sort @timestamp asc\n| limit 50\n```\n\nQueries are async — use `get_logs_insight_query_results` to poll until status is `Complete`.\n\n## Phase 3: Filter OTEL Noise\n\nSee [otel-span-schema.md](references\u002Fotel-span-schema.md) for extraction rules, known scopes, and DROP\u002FKEEP heuristics.\n\nAfter retrieving query results:\n1. Count total results received\n2. Remove entries matching DROP patterns (count removed)\n3. Keep entries matching KEEP patterns\n4. Log: \"Filtered: {total} → {kept} spans ({removed} noise entries dropped)\"\n\n## Phase 4: Build Timeline\n\nCompute relative offsets from the earliest span's `startTimeUnixNano`:\n\n```\n[T+0ms]     Session started — traceId: abc123\n[T+45ms]    LLM inference — model: anthropic.claude-v3 — 1,200ms\n[T+1,250ms] Tool call: search_documents — 340ms\n[T+1,600ms] Tool result: 3 documents found\n[T+1,650ms] LLM inference — model: anthropic.claude-v3 — 890ms\n[T+2,550ms] Response generated — 200 OK\n[T+2,600ms] Session ended — total: 2,600ms\n```\n\n## Error Handling\n\n| Situation | Action |\n|-----------|--------|\n| No log groups found | Ask user for log group name or AWS region |\n| Query returns 0 results | Widen time range to ±24h, retry. If still empty, try alternate ID fields |\n| Session ID not found | Try filtering by requestId, invocationId, traceId variants |\n| Query timeout | Use `cancel_logs_insight_query`, reduce time range, retry |\n| Partial results | Note in output, suggest narrower time window |\n| Structured field queries return 0 results | Switch to glob-style `parse @message` queries (see Parse Syntax Guidance) |\n",{"data":46,"body":47},{"name":4,"description":6},{"type":48,"children":49},"root",[50,59,65,74,104,108,115,120,126,138,155,165,180,190,205,208,214,219,225,238,244,253,259,268,273,279,300,309,315,328,411,423,429,441,450,463,469,481,487,500,566,572,580,589,597,606,612,619,628,635,644,650,657,666,673,682,688,695,704,711,720,726,733,742,749,758,764,771,780,787,796,817,823,834,839,863,869,882,891,897],{"type":51,"tag":52,"props":53,"children":55},"element","h1",{"id":54},"agentcore-runtime-session-investigation",[56],{"type":57,"value":58},"text","AgentCore Runtime Session Investigation",{"type":51,"tag":60,"props":61,"children":62},"p",{},[63],{"type":57,"value":64},"Investigate AgentCore runtime sessions by querying CloudWatch Logs Insights, filtering OpenTelemetry noise, and producing structured investigation output.",{"type":51,"tag":60,"props":66,"children":67},{},[68],{"type":51,"tag":69,"props":70,"children":71},"strong",{},[72],{"type":57,"value":73},"Key capabilities:",{"type":51,"tag":75,"props":76,"children":77},"ul",{},[78,84,89,94,99],{"type":51,"tag":79,"props":80,"children":81},"li",{},[82],{"type":57,"value":83},"Session-to-trace resolution via OTEL span correlation",{"type":51,"tag":79,"props":85,"children":86},{},[87],{"type":57,"value":88},"Structured and glob-style parse queries for both dedicated and combined log groups",{"type":51,"tag":79,"props":90,"children":91},{},[92],{"type":57,"value":93},"OpenTelemetry noise filtering with AgentCore-specific heuristics",{"type":51,"tag":79,"props":95,"children":96},{},[97],{"type":57,"value":98},"Timeline construction with T+offset format",{"type":51,"tag":79,"props":100,"children":101},{},[102],{"type":57,"value":103},"Error, tool invocation, token usage, and latency analysis",{"type":51,"tag":105,"props":106,"children":107},"hr",{},[],{"type":51,"tag":109,"props":110,"children":112},"h2",{"id":111},"reference-files",[113],{"type":57,"value":114},"Reference Files",{"type":51,"tag":60,"props":116,"children":117},{},[118],{"type":57,"value":119},"Load these files as needed for detailed guidance:",{"type":51,"tag":121,"props":122,"children":123},"h3",{"id":32},[124],{"type":57,"value":125},"MCP:",{"type":51,"tag":127,"props":128,"children":130},"h4",{"id":129},"mcp-setupmd",[131],{"type":51,"tag":132,"props":133,"children":135},"a",{"href":134},"mcp\u002Fmcp-setup.md",[136],{"type":57,"value":137},"mcp-setup.md",{"type":51,"tag":60,"props":139,"children":140},{},[141,146,148,153],{"type":51,"tag":69,"props":142,"children":143},{},[144],{"type":57,"value":145},"When:",{"type":57,"value":147}," ALWAYS load before starting an investigation — ensures CloudWatch and Application Signals MCP servers are configured\n",{"type":51,"tag":69,"props":149,"children":150},{},[151],{"type":57,"value":152},"Contains:",{"type":57,"value":154}," MCP server configuration for CloudWatch Logs and Application Signals, with setup instructions for Claude Code, Gemini, Codex, and Kiro CLI",{"type":51,"tag":127,"props":156,"children":158},{"id":157},"mcpjson",[159],{"type":51,"tag":132,"props":160,"children":162},{"href":161},"mcp\u002F.mcp.json",[163],{"type":57,"value":164},".mcp.json",{"type":51,"tag":60,"props":166,"children":167},{},[168,172,174,178],{"type":51,"tag":69,"props":169,"children":170},{},[171],{"type":57,"value":145},{"type":57,"value":173}," Load when setting up MCP servers for the first time\n",{"type":51,"tag":69,"props":175,"children":176},{},[177],{"type":57,"value":152},{"type":57,"value":179}," Sample MCP configuration with both CloudWatch and Application Signals servers",{"type":51,"tag":121,"props":181,"children":183},{"id":182},"otel-span-schemamd",[184],{"type":51,"tag":132,"props":185,"children":187},{"href":186},"references\u002Fotel-span-schema.md",[188],{"type":57,"value":189},"otel-span-schema.md",{"type":51,"tag":60,"props":191,"children":192},{},[193,197,199,203],{"type":51,"tag":69,"props":194,"children":195},{},[196],{"type":57,"value":145},{"type":57,"value":198}," ALWAYS load before querying or filtering OTEL spans\n",{"type":51,"tag":69,"props":200,"children":201},{},[202],{"type":57,"value":152},{"type":57,"value":204}," Field extraction priorities, known instrumentation scopes, noise filtering heuristics (DROP\u002FKEEP patterns)",{"type":51,"tag":105,"props":206,"children":207},{},[],{"type":51,"tag":109,"props":209,"children":211},{"id":210},"phase-0-sessionid-to-traceid-resolution",[212],{"type":57,"value":213},"Phase 0: SessionId-to-TraceId Resolution",{"type":51,"tag":60,"props":215,"children":216},{},[217],{"type":57,"value":218},"When the user provides a sessionId, resolve it to traceId(s) first. If user provides traceId directly, skip this phase.",{"type":51,"tag":121,"props":220,"children":222},{"id":221},"discovery-query-structured-fields",[223],{"type":57,"value":224},"Discovery Query (structured fields)",{"type":51,"tag":226,"props":227,"children":231},"pre",{"className":228,"code":230,"language":57},[229],"language-text","fields traceId, @timestamp\n| filter attributes.session.id = \"SESSION_ID\"\n| stats count(*) as spanCount, min(@timestamp) as firstSeen, max(@timestamp) as lastSeen by traceId\n| sort firstSeen asc\n",[232],{"type":51,"tag":233,"props":234,"children":236},"code",{"__ignoreMap":235},"",[237],{"type":57,"value":230},{"type":51,"tag":121,"props":239,"children":241},{"id":240},"discovery-query-combined-log-group-glob-style-parse",[242],{"type":57,"value":243},"Discovery Query (combined log group — glob-style parse)",{"type":51,"tag":226,"props":245,"children":248},{"className":246,"code":247,"language":57},[229],"fields @timestamp, @message\n| parse @message '\"traceId\":\"*\"' as traceId\n| parse @message '\"session.id\":\"*\"' as sessionId\n| filter sessionId = \"SESSION_ID\" or @message like \"SESSION_ID\"\n| stats earliest(@timestamp) as firstSeen, latest(@timestamp) as lastSeen, count(*) as spanCount by traceId\n| sort firstSeen asc\n| limit 50\n",[249],{"type":51,"tag":233,"props":250,"children":251},{"__ignoreMap":235},[252],{"type":57,"value":247},{"type":51,"tag":121,"props":254,"children":256},{"id":255},"latest-interaction-only",[257],{"type":57,"value":258},"Latest Interaction Only",{"type":51,"tag":226,"props":260,"children":263},{"className":261,"code":262,"language":57},[229],"fields traceId\n| filter attributes.session.id = \"SESSION_ID\"\n| sort @timestamp desc\n| limit 1\n",[264],{"type":51,"tag":233,"props":265,"children":266},{"__ignoreMap":235},[267],{"type":57,"value":262},{"type":51,"tag":60,"props":269,"children":270},{},[271],{"type":57,"value":272},"Store discovered traceId(s) and use them in ALL subsequent queries.",{"type":51,"tag":109,"props":274,"children":276},{"id":275},"phase-1-discover-log-groups",[277],{"type":57,"value":278},"Phase 1: Discover Log Groups",{"type":51,"tag":60,"props":280,"children":281},{},[282,284,290,292,298],{"type":57,"value":283},"Use ",{"type":51,"tag":233,"props":285,"children":287},{"className":286},[],[288],{"type":57,"value":289},"describe_log_groups",{"type":57,"value":291}," with logGroupNamePrefix ",{"type":51,"tag":233,"props":293,"children":295},{"className":294},[],[296],{"type":57,"value":297},"\u002Faws\u002Fbedrock-agentcore\u002Fruntimes",{"type":57,"value":299}," to find all runtime log groups.",{"type":51,"tag":226,"props":301,"children":304},{"className":302,"code":303,"language":57},[229],"Log group naming patterns (in priority order):\n- \u002Faws\u002Fbedrock-agentcore\u002Fruntimes\u002F\u003Cagent_id>-\u003Cendpoint_name>\u002Fotel-rt-logs (structured OTEL spans)\n- \u002Faws\u002Fbedrock-agentcore\u002Fruntimes\u002F\u003Cagent_id>-\u003Cendpoint_name>\u002F[runtime-logs] (stdout\u002Fstderr)\n- \u002Faws\u002Fbedrock-agentcore\u002Fruntimes\u002F\u003Cagent_id>-\u003Cendpoint_name>-DEFAULT (single combined group)\n",[305],{"type":51,"tag":233,"props":306,"children":307},{"__ignoreMap":235},[308],{"type":57,"value":303},{"type":51,"tag":121,"props":310,"children":312},{"id":311},"log-group-layouts",[313],{"type":57,"value":314},"Log Group Layouts",{"type":51,"tag":60,"props":316,"children":317},{},[318,320,326],{"type":57,"value":319},"AgentCore runtimes always emit OTEL spans. Some deployments split logs into a dedicated ",{"type":51,"tag":233,"props":321,"children":323},{"className":322},[],[324],{"type":57,"value":325},"otel-rt-logs",{"type":57,"value":327}," sub-group; others write everything into a single combined log group. Both are normal.",{"type":51,"tag":329,"props":330,"children":331},"table",{},[332,351],{"type":51,"tag":333,"props":334,"children":335},"thead",{},[336],{"type":51,"tag":337,"props":338,"children":339},"tr",{},[340,346],{"type":51,"tag":341,"props":342,"children":343},"th",{},[344],{"type":57,"value":345},"Log Group Layout",{"type":51,"tag":341,"props":347,"children":348},{},[349],{"type":57,"value":350},"Query Strategy",{"type":51,"tag":352,"props":353,"children":354},"tbody",{},[355,392],{"type":51,"tag":337,"props":356,"children":357},{},[358,371],{"type":51,"tag":359,"props":360,"children":361},"td",{},[362,364,369],{"type":57,"value":363},"Dedicated ",{"type":51,"tag":233,"props":365,"children":367},{"className":366},[],[368],{"type":57,"value":325},{"type":57,"value":370}," exists",{"type":51,"tag":359,"props":372,"children":373},{},[374,376,382,384,390],{"type":57,"value":375},"Use structured field queries (",{"type":51,"tag":233,"props":377,"children":379},{"className":378},[],[380],{"type":57,"value":381},"traceId",{"type":57,"value":383},", ",{"type":51,"tag":233,"props":385,"children":387},{"className":386},[],[388],{"type":57,"value":389},"attributes.session.id",{"type":57,"value":391},", etc.)",{"type":51,"tag":337,"props":393,"children":394},{},[395,400],{"type":51,"tag":359,"props":396,"children":397},{},[398],{"type":57,"value":399},"Single combined log group",{"type":51,"tag":359,"props":401,"children":402},{},[403,405],{"type":57,"value":404},"Try structured fields first — if they return 0 results, use glob-style ",{"type":51,"tag":233,"props":406,"children":408},{"className":407},[],[409],{"type":57,"value":410},"parse @message",{"type":51,"tag":60,"props":412,"children":413},{},[414,416,421],{"type":57,"value":415},"If a dedicated ",{"type":51,"tag":233,"props":417,"children":419},{"className":418},[],[420],{"type":57,"value":325},{"type":57,"value":422}," group exists, prefer it for structured queries.",{"type":51,"tag":121,"props":424,"children":426},{"id":425},"parse-syntax-guidance",[427],{"type":57,"value":428},"Parse Syntax Guidance",{"type":51,"tag":60,"props":430,"children":431},{},[432,434,439],{"type":57,"value":433},"When using ",{"type":51,"tag":233,"props":435,"children":437},{"className":436},[],[438],{"type":57,"value":410},{"type":57,"value":440}," on combined log groups, prefer glob-style parse — it is simpler and avoids escaping issues:",{"type":51,"tag":226,"props":442,"children":445},{"className":443,"code":444,"language":57},[229],"| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"traceId\":\"*\"' as traceId\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n",[446],{"type":51,"tag":233,"props":447,"children":448},{"__ignoreMap":235},[449],{"type":57,"value":444},{"type":51,"tag":60,"props":451,"children":452},{},[453,455,461],{"type":57,"value":454},"Regex parse (",{"type":51,"tag":233,"props":456,"children":458},{"className":457},[],[459],{"type":57,"value":460},"\u002Fpattern\u002F",{"type":57,"value":462},") is valid CloudWatch Logs Insights syntax but requires careful escaping of quotes and special characters inside JSON. If glob-style parse extracts the field you need, use it.",{"type":51,"tag":109,"props":464,"children":466},{"id":465},"phase-2-query-cloudwatch-logs-insights",[467],{"type":57,"value":468},"Phase 2: Query CloudWatch Logs Insights",{"type":51,"tag":60,"props":470,"children":471},{},[472,474,479],{"type":57,"value":473},"Run all 6 query types for a complete investigation. Each query has a structured version (for dedicated ",{"type":51,"tag":233,"props":475,"children":477},{"className":476},[],[478],{"type":57,"value":325},{"type":57,"value":480},") and a glob-style parse version (for combined log groups).",{"type":51,"tag":121,"props":482,"children":484},{"id":483},"query-size-limits",[485],{"type":57,"value":486},"Query Size Limits",{"type":51,"tag":60,"props":488,"children":489},{},[490,492,498],{"type":57,"value":491},"Every query MUST include ",{"type":51,"tag":233,"props":493,"children":495},{"className":494},[],[496],{"type":57,"value":497},"| limit",{"type":57,"value":499}," to prevent context window overflow:",{"type":51,"tag":75,"props":501,"children":502},{},[503,514,525,535,545,555],{"type":51,"tag":79,"props":504,"children":505},{},[506,508],{"type":57,"value":507},"Session overview: ",{"type":51,"tag":233,"props":509,"children":511},{"className":510},[],[512],{"type":57,"value":513},"| limit 50",{"type":51,"tag":79,"props":515,"children":516},{},[517,519],{"type":57,"value":518},"Span details: ",{"type":51,"tag":233,"props":520,"children":522},{"className":521},[],[523],{"type":57,"value":524},"| limit 100",{"type":51,"tag":79,"props":526,"children":527},{},[528,530],{"type":57,"value":529},"Errors: ",{"type":51,"tag":233,"props":531,"children":533},{"className":532},[],[534],{"type":57,"value":513},{"type":51,"tag":79,"props":536,"children":537},{},[538,540],{"type":57,"value":539},"Tool invocations: ",{"type":51,"tag":233,"props":541,"children":543},{"className":542},[],[544],{"type":57,"value":524},{"type":51,"tag":79,"props":546,"children":547},{},[548,550],{"type":57,"value":549},"Token usage: ",{"type":51,"tag":233,"props":551,"children":553},{"className":552},[],[554],{"type":57,"value":513},{"type":51,"tag":79,"props":556,"children":557},{},[558,560],{"type":57,"value":559},"Latency outliers: ",{"type":51,"tag":233,"props":561,"children":563},{"className":562},[],[564],{"type":57,"value":565},"| limit 20",{"type":51,"tag":121,"props":567,"children":569},{"id":568},"query-1-session-overview",[570],{"type":57,"value":571},"Query 1: Session Overview",{"type":51,"tag":60,"props":573,"children":574},{},[575],{"type":51,"tag":69,"props":576,"children":577},{},[578],{"type":57,"value":579},"Structured:",{"type":51,"tag":226,"props":581,"children":584},{"className":582,"code":583,"language":57},[229],"fields @timestamp, traceId, spanId, parentSpanId, name, scope.name,\n       attributes.session.id, attributes.gen_ai.operation.name, attributes.gen_ai.agent.name,\n       startTimeUnixNano, endTimeUnixNano\n| filter traceId = \"TRACE_ID\"\n| sort startTimeUnixNano asc\n| limit 50\n",[585],{"type":51,"tag":233,"props":586,"children":587},{"__ignoreMap":235},[588],{"type":57,"value":583},{"type":51,"tag":60,"props":590,"children":591},{},[592],{"type":51,"tag":69,"props":593,"children":594},{},[595],{"type":57,"value":596},"Combined log group:",{"type":51,"tag":226,"props":598,"children":601},{"className":599,"code":600,"language":57},[229],"fields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"traceId\":\"*\"' as traceId\n| parse @message '\"spanId\":\"*\"' as spanId\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n| parse @message '\"endTimeUnixNano\":\"*\"' as endNano\n| sort @timestamp asc\n| limit 50\n",[602],{"type":51,"tag":233,"props":603,"children":604},{"__ignoreMap":235},[605],{"type":57,"value":600},{"type":51,"tag":121,"props":607,"children":609},{"id":608},"query-2-span-details-with-duration",[610],{"type":57,"value":611},"Query 2: Span Details with Duration",{"type":51,"tag":60,"props":613,"children":614},{},[615],{"type":51,"tag":69,"props":616,"children":617},{},[618],{"type":57,"value":579},{"type":51,"tag":226,"props":620,"children":623},{"className":621,"code":622,"language":57},[229],"fields @timestamp, traceId, spanId, parentSpanId, name, scope.name,\n       startTimeUnixNano, endTimeUnixNano,\n       (endTimeUnixNano - startTimeUnixNano) \u002F 1000000 as durationMs,\n       status.code, attributes.gen_ai.operation.name\n| filter traceId = \"TRACE_ID\"\n| filter ispresent(startTimeUnixNano)\n| sort startTimeUnixNano asc\n| limit 100\n",[624],{"type":51,"tag":233,"props":625,"children":626},{"__ignoreMap":235},[627],{"type":57,"value":622},{"type":51,"tag":60,"props":629,"children":630},{},[631],{"type":51,"tag":69,"props":632,"children":633},{},[634],{"type":57,"value":596},{"type":51,"tag":226,"props":636,"children":639},{"className":637,"code":638,"language":57},[229],"fields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"spanId\":\"*\"' as spanId\n| parse @message '\"parentSpanId\":\"*\"' as parentSpanId\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n| parse @message '\"endTimeUnixNano\":\"*\"' as endNano\n| parse @message '\"statusCode\":\"*\"' as statusCode\n| sort @timestamp asc\n| limit 100\n",[640],{"type":51,"tag":233,"props":641,"children":642},{"__ignoreMap":235},[643],{"type":57,"value":638},{"type":51,"tag":121,"props":645,"children":647},{"id":646},"query-3-errors",[648],{"type":57,"value":649},"Query 3: Errors",{"type":51,"tag":60,"props":651,"children":652},{},[653],{"type":51,"tag":69,"props":654,"children":655},{},[656],{"type":57,"value":579},{"type":51,"tag":226,"props":658,"children":661},{"className":659,"code":660,"language":57},[229],"fields @timestamp, traceId, spanId, name, status.code, status.message,\n       attributes.error.message, attributes.exception.message, attributes.exception.type\n| filter traceId = \"TRACE_ID\"\n| filter status.code = 2 OR ispresent(attributes.error.message) OR ispresent(attributes.exception.message)\n| sort @timestamp asc\n| limit 50\n",[662],{"type":51,"tag":233,"props":663,"children":664},{"__ignoreMap":235},[665],{"type":57,"value":660},{"type":51,"tag":60,"props":667,"children":668},{},[669],{"type":51,"tag":69,"props":670,"children":671},{},[672],{"type":57,"value":596},{"type":51,"tag":226,"props":674,"children":677},{"className":675,"code":676,"language":57},[229],"fields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| filter @message like \u002FERROR|exception|Exception|fault|STATUS_CODE_ERROR\u002F\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"statusCode\":\"*\"' as statusCode\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n| sort @timestamp asc\n| limit 50\n",[678],{"type":51,"tag":233,"props":679,"children":680},{"__ignoreMap":235},[681],{"type":57,"value":676},{"type":51,"tag":121,"props":683,"children":685},{"id":684},"query-4-tool-invocations",[686],{"type":57,"value":687},"Query 4: Tool Invocations",{"type":51,"tag":60,"props":689,"children":690},{},[691],{"type":51,"tag":69,"props":692,"children":693},{},[694],{"type":57,"value":579},{"type":51,"tag":226,"props":696,"children":699},{"className":697,"code":698,"language":57},[229],"fields @timestamp, traceId, spanId, name, scope.name,\n       attributes.gen_ai.operation.name, attributes.tool.name,\n       startTimeUnixNano, endTimeUnixNano,\n       (endTimeUnixNano - startTimeUnixNano) \u002F 1000000 as durationMs\n| filter traceId = \"TRACE_ID\"\n| filter attributes.gen_ai.operation.name = \"execute_tool\" OR ispresent(attributes.tool.name) OR name like \u002Ftool\u002F\n| sort startTimeUnixNano asc\n| limit 100\n",[700],{"type":51,"tag":233,"props":701,"children":702},{"__ignoreMap":235},[703],{"type":57,"value":698},{"type":51,"tag":60,"props":705,"children":706},{},[707],{"type":51,"tag":69,"props":708,"children":709},{},[710],{"type":57,"value":596},{"type":51,"tag":226,"props":712,"children":715},{"className":713,"code":714,"language":57},[229],"fields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| filter @message like \u002Ftool|execute_tool|function_call\u002F\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n| parse @message '\"endTimeUnixNano\":\"*\"' as endNano\n| parse @message '\"statusCode\":\"*\"' as statusCode\n| sort @timestamp asc\n| limit 100\n",[716],{"type":51,"tag":233,"props":717,"children":718},{"__ignoreMap":235},[719],{"type":57,"value":714},{"type":51,"tag":121,"props":721,"children":723},{"id":722},"query-5-token-usage",[724],{"type":57,"value":725},"Query 5: Token Usage",{"type":51,"tag":60,"props":727,"children":728},{},[729],{"type":51,"tag":69,"props":730,"children":731},{},[732],{"type":57,"value":579},{"type":51,"tag":226,"props":734,"children":737},{"className":735,"code":736,"language":57},[229],"fields @timestamp, traceId, spanId, name,\n       attributes.gen_ai.usage.input_tokens, attributes.gen_ai.usage.output_tokens,\n       attributes.gen_ai.usage.total_tokens, attributes.gen_ai.agent.name\n| filter traceId = \"TRACE_ID\"\n| filter ispresent(attributes.gen_ai.usage.total_tokens)\n| sort @timestamp asc\n| limit 50\n",[738],{"type":51,"tag":233,"props":739,"children":740},{"__ignoreMap":235},[741],{"type":57,"value":736},{"type":51,"tag":60,"props":743,"children":744},{},[745],{"type":51,"tag":69,"props":746,"children":747},{},[748],{"type":57,"value":596},{"type":51,"tag":226,"props":750,"children":753},{"className":751,"code":752,"language":57},[229],"fields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| filter @message like \u002Finput_tokens|output_tokens|usage\u002F\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"gen_ai.usage.input_tokens\"' as hasTokens\n| sort @timestamp asc\n| limit 50\n",[754],{"type":51,"tag":233,"props":755,"children":756},{"__ignoreMap":235},[757],{"type":57,"value":752},{"type":51,"tag":121,"props":759,"children":761},{"id":760},"query-6-latency-outliers",[762],{"type":57,"value":763},"Query 6: Latency Outliers",{"type":51,"tag":60,"props":765,"children":766},{},[767],{"type":51,"tag":69,"props":768,"children":769},{},[770],{"type":57,"value":579},{"type":51,"tag":226,"props":772,"children":775},{"className":773,"code":774,"language":57},[229],"fields @timestamp, traceId, spanId, name,\n       (endTimeUnixNano - startTimeUnixNano) \u002F 1000000 as durationMs\n| filter traceId = \"TRACE_ID\"\n| filter ispresent(endTimeUnixNano)\n| sort durationMs desc\n| limit 20\n",[776],{"type":51,"tag":233,"props":777,"children":778},{"__ignoreMap":235},[779],{"type":57,"value":774},{"type":51,"tag":60,"props":781,"children":782},{},[783],{"type":51,"tag":69,"props":784,"children":785},{},[786],{"type":57,"value":596},{"type":51,"tag":226,"props":788,"children":791},{"className":789,"code":790,"language":57},[229],"fields @timestamp, @message\n| filter @message like \"TRACE_ID\"\n| parse @message '\"name\":\"*\"' as spanName\n| parse @message '\"startTimeUnixNano\":\"*\"' as startNano\n| parse @message '\"endTimeUnixNano\":\"*\"' as endNano\n| sort @timestamp asc\n| limit 50\n",[792],{"type":51,"tag":233,"props":793,"children":794},{"__ignoreMap":235},[795],{"type":57,"value":790},{"type":51,"tag":60,"props":797,"children":798},{},[799,801,807,809,815],{"type":57,"value":800},"Queries are async — use ",{"type":51,"tag":233,"props":802,"children":804},{"className":803},[],[805],{"type":57,"value":806},"get_logs_insight_query_results",{"type":57,"value":808}," to poll until status is ",{"type":51,"tag":233,"props":810,"children":812},{"className":811},[],[813],{"type":57,"value":814},"Complete",{"type":57,"value":816},".",{"type":51,"tag":109,"props":818,"children":820},{"id":819},"phase-3-filter-otel-noise",[821],{"type":57,"value":822},"Phase 3: Filter OTEL Noise",{"type":51,"tag":60,"props":824,"children":825},{},[826,828,832],{"type":57,"value":827},"See ",{"type":51,"tag":132,"props":829,"children":830},{"href":186},[831],{"type":57,"value":189},{"type":57,"value":833}," for extraction rules, known scopes, and DROP\u002FKEEP heuristics.",{"type":51,"tag":60,"props":835,"children":836},{},[837],{"type":57,"value":838},"After retrieving query results:",{"type":51,"tag":840,"props":841,"children":842},"ol",{},[843,848,853,858],{"type":51,"tag":79,"props":844,"children":845},{},[846],{"type":57,"value":847},"Count total results received",{"type":51,"tag":79,"props":849,"children":850},{},[851],{"type":57,"value":852},"Remove entries matching DROP patterns (count removed)",{"type":51,"tag":79,"props":854,"children":855},{},[856],{"type":57,"value":857},"Keep entries matching KEEP patterns",{"type":51,"tag":79,"props":859,"children":860},{},[861],{"type":57,"value":862},"Log: \"Filtered: {total} → {kept} spans ({removed} noise entries dropped)\"",{"type":51,"tag":109,"props":864,"children":866},{"id":865},"phase-4-build-timeline",[867],{"type":57,"value":868},"Phase 4: Build Timeline",{"type":51,"tag":60,"props":870,"children":871},{},[872,874,880],{"type":57,"value":873},"Compute relative offsets from the earliest span's ",{"type":51,"tag":233,"props":875,"children":877},{"className":876},[],[878],{"type":57,"value":879},"startTimeUnixNano",{"type":57,"value":881},":",{"type":51,"tag":226,"props":883,"children":886},{"className":884,"code":885,"language":57},[229],"[T+0ms]     Session started — traceId: abc123\n[T+45ms]    LLM inference — model: anthropic.claude-v3 — 1,200ms\n[T+1,250ms] Tool call: search_documents — 340ms\n[T+1,600ms] Tool result: 3 documents found\n[T+1,650ms] LLM inference — model: anthropic.claude-v3 — 890ms\n[T+2,550ms] Response generated — 200 OK\n[T+2,600ms] Session ended — total: 2,600ms\n",[887],{"type":51,"tag":233,"props":888,"children":889},{"__ignoreMap":235},[890],{"type":57,"value":885},{"type":51,"tag":109,"props":892,"children":894},{"id":893},"error-handling",[895],{"type":57,"value":896},"Error Handling",{"type":51,"tag":329,"props":898,"children":899},{},[900,916],{"type":51,"tag":333,"props":901,"children":902},{},[903],{"type":51,"tag":337,"props":904,"children":905},{},[906,911],{"type":51,"tag":341,"props":907,"children":908},{},[909],{"type":57,"value":910},"Situation",{"type":51,"tag":341,"props":912,"children":913},{},[914],{"type":57,"value":915},"Action",{"type":51,"tag":352,"props":917,"children":918},{},[919,932,945,958,978,991],{"type":51,"tag":337,"props":920,"children":921},{},[922,927],{"type":51,"tag":359,"props":923,"children":924},{},[925],{"type":57,"value":926},"No log groups found",{"type":51,"tag":359,"props":928,"children":929},{},[930],{"type":57,"value":931},"Ask user for log group name or AWS region",{"type":51,"tag":337,"props":933,"children":934},{},[935,940],{"type":51,"tag":359,"props":936,"children":937},{},[938],{"type":57,"value":939},"Query returns 0 results",{"type":51,"tag":359,"props":941,"children":942},{},[943],{"type":57,"value":944},"Widen time range to ±24h, retry. If still empty, try alternate ID fields",{"type":51,"tag":337,"props":946,"children":947},{},[948,953],{"type":51,"tag":359,"props":949,"children":950},{},[951],{"type":57,"value":952},"Session ID not found",{"type":51,"tag":359,"props":954,"children":955},{},[956],{"type":57,"value":957},"Try filtering by requestId, invocationId, traceId variants",{"type":51,"tag":337,"props":959,"children":960},{},[961,966],{"type":51,"tag":359,"props":962,"children":963},{},[964],{"type":57,"value":965},"Query timeout",{"type":51,"tag":359,"props":967,"children":968},{},[969,970,976],{"type":57,"value":283},{"type":51,"tag":233,"props":971,"children":973},{"className":972},[],[974],{"type":57,"value":975},"cancel_logs_insight_query",{"type":57,"value":977},", reduce time range, retry",{"type":51,"tag":337,"props":979,"children":980},{},[981,986],{"type":51,"tag":359,"props":982,"children":983},{},[984],{"type":57,"value":985},"Partial results",{"type":51,"tag":359,"props":987,"children":988},{},[989],{"type":57,"value":990},"Note in output, suggest narrower time window",{"type":51,"tag":337,"props":992,"children":993},{},[994,999],{"type":51,"tag":359,"props":995,"children":996},{},[997],{"type":57,"value":998},"Structured field queries return 0 results",{"type":51,"tag":359,"props":1000,"children":1001},{},[1002,1004,1009],{"type":57,"value":1003},"Switch to glob-style ",{"type":51,"tag":233,"props":1005,"children":1007},{"className":1006},[],[1008],{"type":57,"value":410},{"type":57,"value":1010}," queries (see Parse Syntax Guidance)",{"items":1012,"total":1097},[1013,1020,1041,1051,1064,1077,1087],{"slug":4,"name":4,"fn":5,"description":6,"org":1014,"tags":1015,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1016,1017,1018,1019],{"name":21,"slug":22,"type":16},{"name":24,"slug":25,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"slug":1021,"name":1022,"fn":1023,"description":1024,"org":1025,"tags":1026,"stars":26,"repoUrl":27,"updatedAt":1040},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1027,1030,1031,1034,1037],{"name":1028,"slug":1029,"type":16},"Aurora","aurora",{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},"Database","database",{"name":1035,"slug":1036,"type":16},"Serverless","serverless",{"name":1038,"slug":1039,"type":16},"SQL","sql","2026-07-12T08:36:45.053393",{"slug":1042,"name":1043,"fn":1023,"description":1024,"org":1044,"tags":1045,"stars":26,"repoUrl":27,"updatedAt":1050},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1046,1047,1048,1049],{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},{"name":1035,"slug":1036,"type":16},{"name":1038,"slug":1039,"type":16},"2026-07-12T08:36:42.694299",{"slug":1052,"name":1053,"fn":1023,"description":1024,"org":1054,"tags":1055,"stars":26,"repoUrl":27,"updatedAt":1063},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1056,1057,1058,1061,1062],{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},{"name":1059,"slug":1060,"type":16},"Migration","migration",{"name":1035,"slug":1036,"type":16},{"name":1038,"slug":1039,"type":16},"2026-07-12T08:36:38.584057",{"slug":1065,"name":1066,"fn":1023,"description":1024,"org":1067,"tags":1068,"stars":26,"repoUrl":27,"updatedAt":1076},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1069,1070,1071,1074,1075],{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},{"name":1072,"slug":1073,"type":16},"PostgreSQL","postgresql",{"name":1035,"slug":1036,"type":16},{"name":1038,"slug":1039,"type":16},"2026-07-12T08:36:46.530743",{"slug":1078,"name":1079,"fn":1023,"description":1024,"org":1080,"tags":1081,"stars":26,"repoUrl":27,"updatedAt":1086},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1082,1083,1084,1085],{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},{"name":1035,"slug":1036,"type":16},{"name":1038,"slug":1039,"type":16},"2026-07-12T08:36:48.104182",{"slug":1088,"name":1088,"fn":1023,"description":1024,"org":1089,"tags":1090,"stars":26,"repoUrl":27,"updatedAt":1096},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1091,1092,1093,1094,1095],{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},{"name":1059,"slug":1060,"type":16},{"name":1035,"slug":1036,"type":16},{"name":1038,"slug":1039,"type":16},"2026-07-12T08:36:36.374512",7,{"items":1099,"total":1234},[1100,1107,1115,1122,1130,1138,1145,1153,1174,1189,1204,1219],{"slug":4,"name":4,"fn":5,"description":6,"org":1101,"tags":1102,"stars":26,"repoUrl":27,"updatedAt":28},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1103,1104,1105,1106],{"name":21,"slug":22,"type":16},{"name":24,"slug":25,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"slug":1021,"name":1022,"fn":1023,"description":1024,"org":1108,"tags":1109,"stars":26,"repoUrl":27,"updatedAt":1040},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1110,1111,1112,1113,1114],{"name":1028,"slug":1029,"type":16},{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},{"name":1035,"slug":1036,"type":16},{"name":1038,"slug":1039,"type":16},{"slug":1042,"name":1043,"fn":1023,"description":1024,"org":1116,"tags":1117,"stars":26,"repoUrl":27,"updatedAt":1050},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1118,1119,1120,1121],{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},{"name":1035,"slug":1036,"type":16},{"name":1038,"slug":1039,"type":16},{"slug":1052,"name":1053,"fn":1023,"description":1024,"org":1123,"tags":1124,"stars":26,"repoUrl":27,"updatedAt":1063},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1125,1126,1127,1128,1129],{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},{"name":1059,"slug":1060,"type":16},{"name":1035,"slug":1036,"type":16},{"name":1038,"slug":1039,"type":16},{"slug":1065,"name":1066,"fn":1023,"description":1024,"org":1131,"tags":1132,"stars":26,"repoUrl":27,"updatedAt":1076},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1133,1134,1135,1136,1137],{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},{"name":1072,"slug":1073,"type":16},{"name":1035,"slug":1036,"type":16},{"name":1038,"slug":1039,"type":16},{"slug":1078,"name":1079,"fn":1023,"description":1024,"org":1139,"tags":1140,"stars":26,"repoUrl":27,"updatedAt":1086},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1141,1142,1143,1144],{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},{"name":1035,"slug":1036,"type":16},{"name":1038,"slug":1039,"type":16},{"slug":1088,"name":1088,"fn":1023,"description":1024,"org":1146,"tags":1147,"stars":26,"repoUrl":27,"updatedAt":1096},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1148,1149,1150,1151,1152],{"name":21,"slug":22,"type":16},{"name":1032,"slug":1033,"type":16},{"name":1059,"slug":1060,"type":16},{"name":1035,"slug":1036,"type":16},{"name":1038,"slug":1039,"type":16},{"slug":1154,"name":1154,"fn":1155,"description":1156,"org":1157,"tags":1158,"stars":1171,"repoUrl":1172,"updatedAt":1173},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1159,1162,1165,1168],{"name":1160,"slug":1161,"type":16},"Accounting","accounting",{"name":1163,"slug":1164,"type":16},"Analytics","analytics",{"name":1166,"slug":1167,"type":16},"Cost Optimization","cost-optimization",{"name":1169,"slug":1170,"type":16},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":1175,"name":1175,"fn":1176,"description":1177,"org":1178,"tags":1179,"stars":1171,"repoUrl":1172,"updatedAt":1188},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1180,1181,1182,1185],{"name":21,"slug":22,"type":16},{"name":1169,"slug":1170,"type":16},{"name":1183,"slug":1184,"type":16},"Management","management",{"name":1186,"slug":1187,"type":16},"Reporting","reporting","2026-07-12T08:40:02.066471",{"slug":1190,"name":1190,"fn":1191,"description":1192,"org":1193,"tags":1194,"stars":1171,"repoUrl":1172,"updatedAt":1203},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1195,1196,1197,1200],{"name":1163,"slug":1164,"type":16},{"name":1169,"slug":1170,"type":16},{"name":1198,"slug":1199,"type":16},"Financial Statements","financial-statements",{"name":1201,"slug":1202,"type":16},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":1205,"name":1205,"fn":1206,"description":1207,"org":1208,"tags":1209,"stars":1171,"repoUrl":1172,"updatedAt":1218},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1210,1213,1216],{"name":1211,"slug":1212,"type":16},"Automation","automation",{"name":1214,"slug":1215,"type":16},"Documents","documents",{"name":1217,"slug":1205,"type":16},"PDF","2026-07-12T08:41:44.135656",{"slug":1220,"name":1220,"fn":1221,"description":1222,"org":1223,"tags":1224,"stars":1171,"repoUrl":1172,"updatedAt":1233},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1225,1226,1229,1230],{"name":1160,"slug":1161,"type":16},{"name":1227,"slug":1228,"type":16},"Data Analysis","data-analysis",{"name":1169,"slug":1170,"type":16},{"name":1231,"slug":1232,"type":16},"KPI","kpi","2026-07-12T08:39:59.54971",150]