Cloudwatch Insights grab lambda latest invocation message

Question

I have few lambda cron jobs functions. I would like to run another lambda function once a day and grab the latest log for each lambda. Based on this log I would generate a simple report and notify slack.

The lambda function wrote in python using boto3.

The report should look something like this:

Lambda-1 - ERROR - LOG
Lambda-2 - Succeeded
Lambda-3 - Succeeded (warn) - warn_message

Currently, I face an issue with grabbing the latest lambda log and status from cloudwatch insights.

I have played a bit with this query :

fields @timestamp, @message
| sort @timestamp desc 
| filter level IN ["warn","info","error"] |
 limit 1

This query returns the latest log with this log level. But, this is not the latest lambda invocation. Therefore, there might be some false logs generated.

My question is:

Is there any cloudwatch insight query to grab the latest lambda invocation status and log?
Is there any simpler way to generate the desired report?

Thanks in advance.

samtoddler samtoddler · Accepted Answer · 2021-03-18T12:11:12

when you say latest I assume you mean when your report generating lambda is running. if so you can filter logs based on the timestamp if there are logs during the mentioned timestamp.

StartQuery

and as far as fail status of the lambda is concerned, you can simply make a query or even amend the existing one where you just look for exception if you are logging those in your app or specific error message.

something like

filter @message like /(?i)(Exception|error|fail)/| fields @timestamp, @message
| filter millis > 1546300800  # Tue Jan 01 2019 00:00:00 GMT+0000
     and millis < 1546309800  # Tue Jan 01 2019 02:30:00 GMT+0000

Your python lambda can build and fire this query and based on the results compile the results.

It can further customside by filtering on the logstream name as well

Supported Logs and Discovered Fields

Cloudwatch Insights grab lambda latest invocation message

1 Answers