Filter AWS Cloudwatch Lambda's Log

6
votes

I have a Lambda function and its logs in Cloudwatch (Log group and Log Stream). Is it possible to filter (in Cloudwatch Management Console) all logs that contain "error"? For example logs containing "Process exited before completing request".

3
amazon-web-servicesaws-lambdaamazon-cloudwatch
docs.aws.amazon.com/AmazonCloudWatch/latest/DeveloperGuide/… – Mark B
Thank you @mbaird! I have Metric Filter already created, but maybe I am missing something. Filter does not apply to my logs in CloudWatch Management. Do I need to export logs via CLI or something in order to view it? – bpavlov

3 Answers

3
votes

In Log Groups there is a button "Search Events". You must click on it first.

Then it "changes" to "Filter Streams":

Now you should just type your filter and select the beginning date-time.

0
votes

So this is kind of a side issue, but it was relevant for us. (I posted this to another answer on StackOverflow but thought it would be relevant to this conversation too)

We've noticed that tailing and searching logs gets really slow after a log group has a lot of Log Streams in it, like when an AWS Lambda Function has had a lot of invocations. This is because "tail" type utilities and searching need to connect to each log stream to run. Log Events get expired and deleted due to the policy you set on the Log Group itself, but the Log Streams never get cleaned up. I made a few little utility scripts to help with that:

https://github.com/four43/aws-cloudwatch-log-clean

Hopefully that save you some agony over waiting for those logs to get searched.

0
votes

You can also use CloudWatch Insights (https://aws.amazon.com/about-aws/whats-new/2018/11/announcing-amazon-cloudwatch-logs-insights-fast-interactive-log-analytics/) which is an AWS extension to CloudWatch logs that gives a pretty powerful query and analytics tool. However it can be slow. Some of my queries take up to a minute. Okay, if you really need that data.

You could also use a tool I created called SenseLogs. It downloads CloudWatch data to your browser where you can do queries like you ask about. You can use either full text and search for "error" or if your log data is structured (JSON), you can use a Javascript like expression language to filter by field, eg:

error == 'critical'