Native macOS · For AWS Lambda · Built for AppKit speed

Every AWS Lambda log,
stitched into one story.

Stop scrolling CloudWatch line by line. LogStitch groups every log produced by a single request ID — across functions, accounts and regions — into one coherent invocation you can actually read.

Intel & Apple Silicon · macOS 26.1 or later Credentials in macOS Keychain Works offline — full local history
LogStitch macOS app — single AWS Lambda invocation with stitched CloudWatch log lines, parsed JSON tree, and function navigator
A single AWS Lambda invocation — 15 log lines, parsed JSON, cold-start flag and pattern link — assembled from raw CloudWatch streams.
The CloudWatch problem

Raw CloudWatch streams are a mess.
AWS Lambda invocations are the story.

CloudWatch interleaves log lines from every concurrent execution into one timestamp-sorted river. LogStitch reads the request ID stamped on each line and weaves them back into the invocation they belong to — locally, in milliseconds.

CloudWatch Logs Before

Five concurrent invocations, one log group. Good luck.

LogStitch After

Same logs, regrouped by request ID. Each invocation becomes legible.

What it does

Four things, done obsessively well.

01

Stitch

Logs grouped by request ID, with platform events, JSON parsing and cold-start flags surfaced at a glance.

02

Correlate

Follow a request across functions, accounts and regions with a swim-lane timeline and propagation latency.

03

Analyze

p99 trends, cold-start scatter, memory right-sizing, cost projection — built in, no separate dashboards.

04

Detect

Error patterns auto-clustered. Statistical anomalies on duration, errors, cold starts and cost surface themselves.

The workflow

From AWS profile picker to root cause in three clicks.

Navigator

A function list that actually scales.

1,000+ Lambdas load from local cache in under 200ms. Pin what matters, alias long ARNs, filter by runtime, region or health. Background sync keeps each function's invocation history fresh without you asking.

  • Health badges — color and label, never color alone
  • Per-function sync interval and retention windows
  • Config-change indicators when memory, timeout or runtime drift
  • Auto-detected dependency graph across functions
Functions · log-stitch-serverless
Runtime: Node 22.x × Region: us-west-2 × Health: any 30 of 142
apiHandler.node29.0K · err 6.1K
apiHandler.py25.6K · err 10.8K
authService.go720 · err 5
authService.java720
complianceChecker.node144 · err 144
dataProcessor.go144
dataProcessor.java144
inventoryService.node5.5K · err 414
orderProcessor.node12.4K
paymentService.py8.3K · err 41
webhookProcessor.node3.1K · err 22
Correlation

The whole request, one swim-lane.

Search by request ID or correlation header to surface every invocation a single user action touched — across functions, accounts and regions. Propagation latency between hops, the function that originated the error, and the downstream blast radius are all on one screen.

  • Temporal-proximity correlation when correlation IDs are missing
  • Sparse-chain detection flags missing intermediate hops
  • Interleaved log stream with platform-event dividers
  • Bookmark a correlation group and come back to it
Correlation · req_7d80b199
End-to-end
1,247ms
Functions
5
Origin of error
userRepository @ 412ms
apiGateway
28ms
apiHandler.node
42ms init
312ms
userService.node
187ms
userRepository
timeout 242ms
cacheWarmer
38ms
apiGateway
500
0ms3006009001247ms
Live tail

Real-time, without losing structure.

Open a 15-minute live-tail window on any function. Stream mode shows raw lines as they land; Invocations mode finalises them into the same stitched cards you get from the database. Completed invocations are saved automatically — your live session leaves a permanent trail.

  • Auto-scroll pauses on manual scroll-up
  • Live event-rate, error and cold-start counters
  • Client-side text filter without stopping the stream
  • One-click extension when the session expires
Live Tail · apiHandler.node
Stream
Invocations
LIVE · 14:32 remaining
42.6 events/s7 errs2 cold
14:46:21INFOapiHandlerRequest received POST /api/v2/orders user=usr_01HN…
14:46:21INFOapiHandlerAuth token validated tenantId=tenant_acme_corp
14:46:21DEBUGapiHandlerCache hit key=sess_7031bd86 ttl=12s
14:46:22ERRORapiHandlerDatabase connection timeout — pool exhausted (5/5)
14:46:22ERRORapiHandlerat ConnectionPool.acquire (/var/task/src/db/pool.js:142:15)
14:46:22INFOapiHandlerEND RequestId 67712bf6 duration=242.6ms billed=243ms
14:46:23WARNapiHandlerretry attempt=2 backoff=120ms invocation=a31cf04e
14:46:23INFOapiHandlerDispatching webhook event_id=evt_8c91ad…
14:46:23INFOapiHandlerOrder created order_id=ord_92ba6e total=4288
14:46:24INFOapiHandlerRequest received GET /api/v2/users/me
Analytics

Lambda performance and cost,
in the same window as your logs.

Duration trends, cold-start distributions, memory right-sizing and a working monthly cost projection — all calculated from the data already on your disk.

Analytics · apiHandler.node · last 24h
1h
6h
24h
7d
30d
p99 Duration▲ 18.2%
431msp50 87ms · p95 312ms
Error rate▲ 4.2pp
20.4%294 / 1,440
Projected cost▲ 12.4%
$78.40/mo$2.65 today
Cold starts · by hour24 today · p99 1.84s
Memory utilizationRight-size → 96 MB · save $14/mo
elevated
59% avg · 76% p99
128 MB configured
Detection

The thing that's broken
finds you first.

Recurring errors are clustered into patterns with lifecycle states. Statistical outliers across duration, errors, cold starts and cost surface themselves before customers do.

Error patterns

Log lines with the same message template — even with different request IDs, user IDs and timestamps — collapse into one pattern with a lifecycle, a sparkline and an impact score.

Error ▲ Worsening 2,347 hits · 18.4% of invocations
Unhandled exception processing request statusCode=500 userId={userId}
first seen 4d ago last 12s ago linked JIRA-2841
Timeout ▼ Improving 412 hits · 3.2%
Database connection timeout pool={poolName} waited={ms}ms
first seen 11d ago last 8m ago linked gh#1284
Cold start → Steady 87 hits · 0.7%
INIT_START runtime={runtime} init={ms}ms memory={mb}MB
first seen 30d+ ago last 1m ago runtime impact +1.8s p99

Anomalies

Z-score scoring across duration, error rate, cold-start frequency and cost. Critical (≥3σ) and warning (≥2σ) deviations get badged and grouped. Resolution and auto-dismissal are tracked.

Error rate spike — apiHandler.node
20.4% errors · baseline 4.1% · +3.8σ
14m ago
CRITICAL
Duration regression — userService.node
p99 1.84s · baseline 420ms · +3.1σ
28m ago
CRITICAL
Cold start rate doubled — orderProcessor.node
7.4% cold · baseline 3.1% · +2.4σ
1h ago
WARNING
Cost trajectory — log-stitch-serverless
projected $112/mo · baseline $78/mo · +2.1σ
3h ago
WARNING
Throttle events — paymentService.py
resolved · auto-cleared 12m ago
5h ago
INFO
MCP server

Hand Claude the keys to your CloudWatch — without exposing your account.

LogStitch ships a local Model Context Protocol server, bound to 127.0.0.1 only and never exposed to the network. Point Claude Code at it (or any other MCP-aware tool that can reach a local port) and your assistant can search logs, drill into invocations, run statistical analysis and pull cost projections — all against the local SQLite database. Your AWS credentials never leave the Keychain.

list_functions get_invocation_logs search_logs get_cold_start_analysis get_memory_analysis get_cost_projection list_patterns get_correlated_invocations
Claude Code · LogStitch MCP · localhost:47821
Why did p99 on apiHandler.node spike this afternoon?
→ search_patterns
function="apiHandler.node" since="4h" status="active"
→ get_cold_start_analysis
function="apiHandler.node" window="6h"
Two things compounded at 13:42 UTC. A worsening pattern — Unhandled exception · 500 · userId={userId} — went from 4% to 18% of invocations, and a deploy at 13:38 reset the runtime cache, causing 24 cold starts (init avg 1.8s) inside a 9-minute window. The error pattern is already linked to JIRA-2841.
Everything else

The boring details
done right.

AWS profiles
01
  • Imports ~/.aws/config and credentials
  • Static keys, SSO (OIDC device flow), Assume Role chains
  • Credentials validated via STS before save
  • Color-coded workspace tabs; ⌘⇧P profile switcher
  • Live session countdown with one-click refresh
Log search
02
  • SQLite FTS5 full-text over every cached line
  • Field-aware filters with auto-complete on discovered keys
  • Global cross-function search, grouped by invocation
  • Pin JSON fields as columns in the invocation list
  • Save and re-run filter presets
Background sync
03
  • Per-function intervals; only fetches new data since last cursor
  • Daily CloudWatch API cost budget with auto-pause
  • Exponential backoff on throttling
  • Catch-up detector deprioritises expensive backfills
  • Sync queue dashboard with per-function health
Issue tracking
04
  • Jira Cloud (OAuth 2.0) and GitHub OAuth / App connections
  • Create or link issues with full invocation context
  • Configurable templates with variable placeholders
  • Pattern-level linking with status discrepancy detection
  • Live issue status polling on the invocation
Export
05
  • JSON, CSV, plain text — pick which fields and whether to include log lines
  • Size-limit warnings before writing
  • Determinate progress for large exports
  • Standard NSSavePanel integration
Storage
06
  • Local SQLite with versioned, forward-only migrations
  • Online-backup snapshots; 30-day backup reminder
  • Configurable retention windows; auto-cleanup service
  • Per-table storage stats and pattern cache eviction
Privacy & security

Your logs never leave your machine.

No LogStitch backend. No third-party analytics on log content. No telemetry that includes your data. The app talks to AWS, your local SQLite database, and any issue tracker you've explicitly connected — nothing else.

Keychain credentials
AWS keys, SSO refresh tokens, Jira and GitHub OAuth tokens — stored in macOS Keychain, never written to disk in plaintext.
Direct-to-AWS
CloudWatch APIs are called from your machine. There is no LogStitch server to relay through, intercept, or breach.
Local SQLite
Every log line lives in a single SQLite file on your Mac. Back it up, encrypt it, or delete it — it's yours.
Works offline
Once a function has been synced you can browse, search and analyse its history with the network unplugged.
Get LogStitch

Stop reading log lines.
Read invocations.

A one-time purchase on the Mac App Store. Free 14-day trial — no card, no account, no telemetry.

Personal
$49 one-time
  • For personal & non-commercial projects
  • Unlimited AWS profiles & Lambda functions
  • All analytics & pattern detection
  • Issue-tracker connections (Jira, GitHub)
  • Local MCP server for Claude & AI tools
Coming soon
Pending App Store review
Free 14-day trial · One-time purchase · No subscription
Frequently asked

Questions, answered.

What is LogStitch?
LogStitch is a native macOS app for viewing AWS Lambda logs. It reads the request ID stamped on every CloudWatch log line and stitches the lines back into the invocation they belong to — so you can read a single Lambda execution as one coherent story instead of scrolling timestamp-sorted streams.
How is LogStitch different from CloudWatch Logs Insights?
CloudWatch Logs Insights is a query language over raw log streams in the AWS console. LogStitch is a native Mac app that groups logs into invocations automatically, correlates across accounts and regions, runs entirely on your machine, and ships an MCP server so Claude and other AI tools can query your logs without exposing your AWS account. Full side-by-side comparison →
Do my logs leave my Mac?
No. LogStitch is local-first. Logs are fetched directly from AWS using your own credentials (stored in the macOS Keychain) and stored on your machine. There is no LogStitch cloud component that sees your log data.
Does LogStitch work with multiple AWS accounts and regions?
Yes. LogStitch supports unlimited AWS profiles and correlates invocations across functions, accounts, and regions — useful for any architecture where a single request fans out across multiple Lambdas.
How does LogStitch work with Claude and MCP?
LogStitch ships with a local Model Context Protocol (MCP) server. Claude and other MCP-compatible AI tools can query your CloudWatch logs through LogStitch on your machine, so the AI gets useful answers without ever receiving direct AWS credentials or raw access to your account.
Is LogStitch a subscription?
No. LogStitch is a one-time purchase — $49 Personal (for personal and non-commercial projects) or $99 Business (for commercial use at work). A free 14-day trial is included. There is no recurring subscription.
What macOS versions does LogStitch support?
LogStitch requires macOS 26.1 or later. It's a universal binary that runs natively on both Intel and Apple Silicon Macs.