LogStitch — Invocation-first AWS Lambda observability for macOS

The CloudWatch problem

Raw streams are a mess.
Invocations are the story.

CloudWatch interleaves log lines from every concurrent execution into one timestamp-sorted river. LogStitch reads the request ID stamped on each line and weaves them back into the invocation they belong to — locally, in milliseconds.

CloudWatch Logs Before

Five concurrent invocations, one log group. Good luck.

1:46:05.8337d80b199… START RequestId Version: $LATEST

1:46:05.834a31cf04e… Request received POST /api/v2/orders

1:46:05.836b6e1d722… INIT_START Runtime Version: nodejs:22.v14

1:46:05.8417d80b199… INFO Auth token validated user_id=usr_01HN…

1:46:05.842cc9a4a08… Cache hit key=sess_7031bd86 ttl=12s

1:46:05.844a31cf04e… DEBUG Validating payload schema=order.v3

1:46:05.851b6e1d722… START RequestId Version: $LATEST

1:46:05.8667d80b199… ERROR Database connection timeout (pool exhausted)

1:46:05.871cc9a4a08… END RequestId duration=38ms billed=50ms

1:46:05.873a31cf04e… WARN retry attempt=2 backoff=120ms

1:46:05.8787d80b199… at ConnectionPool.acquire (/var/task/src/db/pool.js…)

1:46:05.881b6e1d722… INFO Request received GET /api/v2/users/me

1:46:05.8867d80b199… at UserRepository.findById (…/repositories/userRepo…)

1:46:05.891a31cf04e… INFO Order created order_id=ord_92ba… total=4288

1:46:05.9217d80b199… ERROR Unhandled exception statusCode=500

1:46:05.954b6e1d722… INFO Dispatching webhook event downstream_id=webh…

LogStitch After

Same logs, regrouped by request ID. Each invocation becomes legible.

Error 7d80b199-058d-672e-bd3d-bd64c94d4372 apiHandler.node

dur 242.6ms mem 82/128MB logs 15 cold no

Success a31cf04e-9321-10cb-c880-16b35c3410d0 orderProcessor.node

dur 187.3ms mem 64/128MB logs 9 cold no

Success b6e1d722-3a4f-4e2b-b8c1-9a31db0c8e44 userService.node

dur 312.0ms mem 71/128MB logs 11 cold yes · 1.8s init

Success cc9a4a08-7e21-4d8a-99e3-2b4ef88a16d5 cacheWarmer.node

dur 38.4ms mem 41/128MB logs 4 cold no

What it does

Four things, done obsessively well.

Stitch

Logs grouped by request ID, with platform events, JSON parsing and cold-start flags surfaced at a glance.

Correlate

Follow a request across functions, accounts and regions with a swim-lane timeline and propagation latency.

Analyze

p99 trends, cold-start scatter, memory right-sizing, cost projection — built in, no separate dashboards.

Detect

Error patterns auto-clustered. Statistical anomalies on duration, errors, cold starts and cost surface themselves.

The workflow

From profile picker to root cause in three clicks.

Navigator

A function list that actually scales.

1,000+ Lambdas load from local cache in under 200ms. Pin what matters, alias long ARNs, filter by runtime, region or health. Background sync keeps each function's invocation history fresh without you asking.

Health badges — color and label, never color alone
Per-function sync interval and retention windows
Config-change indicators when memory, timeout or runtime drift
Auto-detected dependency graph across functions

Functions · log-stitch-serverless

Runtime: Node 22.x × Region: us-west-2 × Health: any 30 of 142

★●apiHandler.node29.0K · err 6.1K

★●apiHandler.py25.6K · err 10.8K

☆●authService.go720 · err 5

☆●authService.java720

☆●complianceChecker.node144 · err 144

☆●dataProcessor.go144

☆●dataProcessor.java144

☆●inventoryService.node5.5K · err 414

☆●orderProcessor.node12.4K

☆●paymentService.py8.3K · err 41

☆●webhookProcessor.node3.1K · err 22

Correlation

The whole request, one swim-lane.

Search by request ID or correlation header to surface every invocation a single user action touched — across functions, accounts and regions. Propagation latency between hops, the function that originated the error, and the downstream blast radius are all on one screen.

Temporal-proximity correlation when correlation IDs are missing
Sparse-chain detection flags missing intermediate hops
Interleaved log stream with platform-event dividers
Bookmark a correlation group and come back to it

Correlation · req_7d80b199

End-to-end

1,247ms

Functions

Origin of error

userRepository @ 412ms

apiGateway

28ms

apiHandler.node

42ms init

312ms

userService.node

187ms

userRepository

timeout 242ms

cacheWarmer

38ms

apiGateway

500

0ms3006009001247ms

Live tail

Real-time, without losing structure.

Open a 15-minute live-tail window on any function. Stream mode shows raw lines as they land; Invocations mode finalises them into the same stitched cards you get from the database. Completed invocations are saved automatically — your live session leaves a permanent trail.

Auto-scroll pauses on manual scroll-up
Live event-rate, error and cold-start counters
Client-side text filter without stopping the stream
One-click extension when the session expires

Live Tail · apiHandler.node

Stream

Invocations

LIVE · 14:32 remaining

42.6 events/s7 errs2 cold

14:46:21INFOapiHandlerRequest received POST /api/v2/orders user=usr_01HN…

14:46:21INFOapiHandlerAuth token validated tenantId=tenant_acme_corp

14:46:21DEBUGapiHandlerCache hit key=sess_7031bd86 ttl=12s

14:46:22ERRORapiHandlerDatabase connection timeout — pool exhausted (5/5)

14:46:22ERRORapiHandlerat ConnectionPool.acquire (/var/task/src/db/pool.js:142:15)

14:46:22INFOapiHandlerEND RequestId 67712bf6 duration=242.6ms billed=243ms

14:46:23WARNapiHandlerretry attempt=2 backoff=120ms invocation=a31cf04e

14:46:23INFOapiHandlerDispatching webhook event_id=evt_8c91ad…

14:46:23INFOapiHandlerOrder created order_id=ord_92ba6e total=4288

14:46:24INFOapiHandlerRequest received GET /api/v2/users/me

Detection

The thing that's broken
finds you first.

Recurring errors are clustered into patterns with lifecycle states. Statistical outliers across duration, errors, cold starts and cost surface themselves before customers do.

Error patterns

Log lines with the same message template — even with different request IDs, user IDs and timestamps — collapse into one pattern with a lifecycle, a sparkline and an impact score.

Error ▲ Worsening 2,347 hits · 18.4% of invocations

Unhandled exception processing request statusCode=500 userId={userId}

first seen 4d ago last 12s ago linked JIRA-2841

Timeout ▼ Improving 412 hits · 3.2%

Database connection timeout pool={poolName} waited={ms}ms

first seen 11d ago last 8m ago linked gh#1284

Cold start → Steady 87 hits · 0.7%

INIT_START runtime={runtime} init={ms}ms memory={mb}MB

first seen 30d+ ago last 1m ago runtime impact +1.8s p99

Anomalies

Z-score scoring across duration, error rate, cold-start frequency and cost. Critical (≥3σ) and warning (≥2σ) deviations get badged and grouped. Resolution and auto-dismissal are tracked.

Error rate spike — apiHandler.node

20.4% errors · baseline 4.1% · +3.8σ

14m ago
CRITICAL

Duration regression — userService.node

p99 1.84s · baseline 420ms · +3.1σ

28m ago
CRITICAL

Cold start rate doubled — orderProcessor.node

7.4% cold · baseline 3.1% · +2.4σ

1h ago
WARNING

Cost trajectory — log-stitch-serverless

projected $112/mo · baseline $78/mo · +2.1σ

3h ago
WARNING

Throttle events — paymentService.py

resolved · auto-cleared 12m ago

5h ago
INFO

MCP server

Hand Claude the keys to your CloudWatch — without exposing your account.

LogStitch ships a local Model Context Protocol server. Point Claude Desktop (or any MCP-aware AI tool) at it and your assistant can search logs, drill into invocations, run statistical analysis and pull cost projections — all against the local SQLite database. Your AWS credentials never leave the Keychain.

list_functions get_invocation_logs search_logs get_cold_start_analysis get_memory_analysis get_cost_projection list_patterns get_correlated_invocations

Claude Desktop · LogStitch MCP · localhost:48913

Why did p99 on apiHandler.node spike this afternoon?

→ search_patterns

function="apiHandler.node" since="4h" status="active"

→ get_cold_start_analysis

function="apiHandler.node" window="6h"

Two things compounded at 13:42 UTC. A worsening pattern — Unhandled exception · 500 · userId={userId} — went from 4% to 18% of invocations, and a deploy at 13:38 reset the runtime cache, causing 24 cold starts (init avg 1.8s) inside a 9-minute window. The error pattern is already linked to JIRA-2841.

Everything else

The boring details
done right.

AWS profiles

Imports ~/.aws/config and credentials
Static keys, SSO (OIDC device flow), Assume Role chains
Credentials validated via STS before save
Color-coded workspace tabs; ⌘⇧P profile switcher
Live session countdown with one-click refresh

Log search

SQLite FTS5 full-text over every cached line
Field-aware filters with auto-complete on discovered keys
Global cross-function search, grouped by invocation
Pin JSON fields as columns in the invocation list
Save and re-run filter presets

Background sync

Per-function intervals; only fetches new data since last cursor
Daily CloudWatch API cost budget with auto-pause
Exponential backoff on throttling
Catch-up detector deprioritises expensive backfills
Sync queue dashboard with per-function health

Issue tracking

Jira Cloud (OAuth 2.0) and GitHub OAuth / App connections
Create or link issues with full invocation context
Configurable templates with variable placeholders
Pattern-level linking with status discrepancy detection
Live issue status polling on the invocation

Export

JSON, CSV, plain text — pick which fields and whether to include log lines
Size-limit warnings before writing
Determinate progress for large exports
Standard NSSavePanel integration

Storage

Local SQLite with versioned, forward-only migrations
Online-backup snapshots; 30-day backup reminder
Configurable retention windows; auto-cleanup service
Per-table storage stats and pattern cache eviction

Privacy & security

Your logs never leave your machine.

No LogStitch backend. No third-party analytics on log content. No telemetry that includes your data. The app talks to AWS, your local SQLite database, and any issue tracker you've explicitly connected — nothing else.

Keychain credentials

AWS keys, SSO refresh tokens, Jira and GitHub OAuth tokens — stored in macOS Keychain, never written to disk in plaintext.

Direct-to-AWS

CloudWatch APIs are called from your machine. There is no LogStitch server to relay through, intercept, or breach.

Local SQLite

Every log line lives in a single SQLite file on your Mac. Back it up, encrypt it, or delete it — it's yours.

Works offline

Once a function has been synced you can browse, search and analyse its history with the network unplugged.

Get LogStitch

Stop reading log lines.
Read invocations.

A one-time purchase on the Mac App Store. Free 14-day trial — no card, no account, no telemetry.

Personal

$49 one-time

Unlimited AWS profiles & Lambda functions
All analytics & pattern detection
Issue-tracker connections (Jira, GitHub)
Local MCP server for Claude & AI tools

Every Lambda log,
stitched into one story.

Raw streams are a mess.
Invocations are the story.

CloudWatch Logs Before

LogStitch After

Four things, done obsessively well.

Stitch

Correlate

Analyze

Detect

From profile picker to root cause in three clicks.

A function list that actually scales.

The whole request, one swim-lane.

Real-time, without losing structure.

Performance and cost,
in the same window as your logs.

The thing that's broken
finds you first.

Error patterns

Anomalies

Hand Claude the keys to your CloudWatch — without exposing your account.

The boring details
done right.

AWS profiles

Log search

Background sync

Issue tracking

Export

Storage

Your logs never leave your machine.

Stop reading log lines.
Read invocations.

Raw streams are a mess.Invocations are the story.

CloudWatch Logs Before

LogStitch After

Four things, done obsessively well.

Stitch

Correlate

Analyze

Detect

From profile picker to root cause in three clicks.

A function list that actually scales.

The whole request, one swim-lane.

Real-time, without losing structure.

Performance and cost,in the same window as your logs.

The thing that's brokenfinds you first.

Error patterns

Anomalies

Hand Claude the keys to your CloudWatch — without exposing your account.

The boring detailsdone right.

AWS profiles

Log search

Background sync

Issue tracking

Export

Storage

Your logs never leave your machine.

Stop reading log lines.Read invocations.

Raw streams are a mess.
Invocations are the story.

Performance and cost,
in the same window as your logs.

The thing that's broken
finds you first.

The boring details
done right.

Stop reading log lines.
Read invocations.