How to Search AWS Lambda Logs in Cloudwatch Logs Insights
Ever deployed an application in AWS Lambda and struggled to check the logs in Cloudwatch?
As opposed to the traditional tailing of a log file or grep command to search in a log file, the Cloudwatch interface is a little different.
So, how to run basic searches in Lambda logs?
We recently built a serverless application using AWS Lambda and API Gateway. We used Cloudwatch logging as the easiest option and could see the logs in Cloudwatch whenever a request is received.
We deployed it in the production and requests started pouring in, and so are the logs. It was working as expected until the business reported an issue with one of the corner cases.
I immediately set out to find the requests matching the reported scenario. It was impossible to search through log streams as it was flooded with a lot of concurrent requests.
After some research, I ended up in logs insights. You can locate it in the Cloudwatch logs section under logs groups.
Cloudwatch Logs Insights provides you a query like interface where you can query logs similar to ELK stack.
Insights is not just targetted to AWS Lambda but could be used for logs from other sources as well. So, you need to select your Lambda function’s “Log Group” from the dropdown and time range you want to restrict the search.
You can modify the query according to your need and then click on “Run Query” to search. The results would be populated with an informative bar graph. You can expand each search result to see the details.
Here are some basic but helpful queries:
- To search requests with exceptions.
fields @message|
filter @message like /Exception/ - To search a request with a particular request id
fields @message|
filter @requestId like /4f6b7964-d97e-4f4a-aa4e-e4f79bfe9b7e/ - To find the slowest requests
filter @type = “REPORT” |
fields @requestId, @billedDuration |
sort by @billedDuration desc
AWS documentation below has a good reference page for useful queries. You can customize these as per your need or write new ones.
References:
