CloudWatch Log¶

CloudWatch Logs invokes your function asynchronously with an event that contains log data.

Request¶

Cloudwatch log structure¶

data (String): The value of the data field is a Base64 encoded ZIP archive.

CloudWatch Logs message event example

{
    "awslogs": {
        "data": "H4sIAAAAAAAAAHWPwQqCQBCGX0Xm7EFtK+smZBEUgXoLCdMhFtKV3akI8d0bLYmibvPPN3wz00CJxmQnTO41whwWQRIctmEcB6sQbFC3CjW3XW8kxpOpP+OC22d1Wml1qZkQGtoMsScxaczKN3plG8zlaHIta5KqWsozoTYw3/djzwhpLwivWFGHGpAFe7DL68JlBUk+l7KSN7tCOEJ4M3/qOI49vMHj+zCKdlFqLaU2ZHV2a4Ct/an0/ivdX8oYc1UVX860fQDQiMdxRQEAAA=="
    }
}

CloudWatch Logs message data (decoded) example

{
    "messageType": "DATA_MESSAGE",
    "owner": "123456789012",
    "logGroup": "/aws/lambda/echo-nodejs",
    "logStream": "2019/03/13/[$LATEST]94fa867e5374431291a7fc14e2f56ae7",
    "subscriptionFilters": [
        "LambdaStream_cloudwatchlogs-node"
    ],
    "logEvents": [
        {
            "id": "34622316099697884706540976068822859012661220141643892546",
            "timestamp": 1552518348220,
            "message": "REPORT RequestId: 6234bffe-149a-b642-81ff-2e8e376d8aff\tDuration: 46.84 ms\tBilled Duration: 47 ms \tMemory Size: 192 MB\tMax Memory Used: 72 MB\t\n"
        }
    ]
}

Generating sample events¶

sam local generate-event cloudwatch logs

Response¶

N/A

Resources¶

Python - CloudWatchLogsEvent - Pip aws-lambda-powertools
Typescript - CloudWatchLogsEvent - NPM @types/aws-lambda
DotNet - CloudWatchLogsEvent - Nuget Amazon.Lambda.CloudWatchLogsEvents
Java - CloudWatchLogsEvent - Maven aws-lambda-java-events
Rust - CloudwatchLogsEvent - Cargo aws-lambda-events
Ruby - LogJob - gem jets

Code Example¶

Python code example using the data class to decode the log data payload

app.py

from aws_lambda_powertools.utilities.data_classes import event_source, CloudWatchLogsEvent
from aws_lambda_powertools.utilities.data_classes.cloud_watch_logs_event import CloudWatchLogsDecodedData

@event_source(data_class=CloudWatchLogsEvent)
def lambda_handler(event: CloudWatchLogsEvent, context):
    decompressed_log: CloudWatchLogsDecodedData = event.parse_logs_data
    log_events = decompressed_log.log_events
    for log_event in log_events:
        do_something_with(log_event.timestamp, log_event.message)

NodeJS code example