amazon-web-services - Can AWS email errors logged to CloudWatch by multiple Lambda functions?

Question

I have many functions in AWS Lambda that are invoked on various periodic schedules by CloudWatch Rules. If their Node JavaScript encounters an error, it’s logged to CloudWatch Log Groups.

• Per this doc, I can create a CloudWatch Simple Notification Service (SNS) to email me.
• Per this doc, I can create a CloudWatch Metric to count occurrences of the word ERROR in a single Log Group.
• Per this doc, I can create a CloudWatch Alarm that uses the SNS to email me when a single Metric is observed.

Can either or both of these two complaints be solved by these tools, or should other tools be used?

• The received email is generic. Can it include the error message?
• This works for only one Lambda function’s one Log Group. Can it be configured to work for multiple Lambda functions’ Log Groups? Can my multiple Lambda functions be configured to log to a single, shared Log Group? Or would I need to create a pair of Metrics and Alarms for each Lambda function?

标签： amazon-web-servicesaws-lambdaamazon-cloudwatchamazon-cloudwatchlogscloudwatch-alarms

Answer 1

TL;DR this is the solution architecture you're probably looking for.

(source: Amazon)

Can my multiple Lambda functions be configured to log to a single, shared Log Group?

No. Even if you could have all your lambda log to a single log group, however, this would be highly inadvisable.

You could, however, stream multiple log groups into a single destination. This is commonly done for centralized logging solutions, for example.

would I need to create a pair of Metrics and Alarms for each Lambda function?

This is probably the most straightforward approach. Using CloudFormation (or related tools, AWS CDK, Terraform, etc) you can automate this setup with the creation of your lambda function.

The received email is generic. Can it include the error message?

Not easily. The CloudWatch Alarm event source won't include any reference to the logs that caused the count metric to go into alarm, so this would not work. Usually, when you receive such an alert, you would use other services to find the errors (e.g. xray, cloudwatch logs, etc). For example, your message may simply include a link to the CloudWatch metric/alarm. From CloudWatch, there should be a 'view logs' button that provides the logs for the metric timeframe. See: Pivot from metrics to logs

If you really need the error to be contained in the notification, a different solution architecture would be needed for this. You could, for example, stream your CloudWatch events to a Lambda function that will process the event and send the notification including the error message from the stream.

See: Real-time processing of log data with subscriptions and How to get notified on specific Lambda function error patterns using CloudWatch which has a full guide to getting your error message in your notifications.

Alternatively, you may want to consider other monitoring solutions, such as sentry, rollbar, NewRelic, DataDog, etc.