How do I configure a CloudWatch subscription filter to invoke my Lambda function?

Short description

With Amazon CloudWatch Logs, you can use a subscription filter that sends log data to your Lambda function.

Note: Large amounts of CloudWatch Logs data can result in high usage charges. It's a best practice to use AWS Budgets to track spending and usage.

Resolution

Create a CloudWatch Logs subscription filter that sends log data to your Lambda function.

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Complete the following steps:

1. To grant CloudWatch Logs permission to invoke your Lambda function, run the following add-permission AWS CLI command:

   aws lambda add-permission \
       --function-name my-function \
       --statement-id my-id \
       --principal logs.amazonaws.com \
       --action lambda:InvokeFunction \
       --source-arn 'arn:aws:logs:region:123456789123:log-group:my-log-group:*' \
       --source-account my-account-id

   Note: Replace my-function with your function name and my-id with your statement ID. Replace region with your AWS Region, my-log-group with your log group ARN, and my-account-id with your AWS account ID.

2. To create a subscription filter to send log events that contain a keyword, run the following put-subscription-filter AWS CLI command:

   aws logs put-subscription-filter \
       --log-group-name my-log-group \
       --filter-name my-filter \
       --filter-pattern "ERROR" \
       --destination-arn arn:aws:lambda:my-region:123456789123:function:my-function-name

   Note: Replace my-log-group with your log group name, my-filter with your filter name, and my-region with your AWS Region. Replace 123456789123 with your account ID and my-function-name with your function name.

The preceding CloudWatch Logs log group invokes the Lambda function when the log group receives a log event that contains the keyword ERROR, similar to the following:

{
  "awslogs": {
    "data": "H4sIAAAAAAAAAHWPwQqCQBCGX0Xm7EFtK+smZBEUgXoLCdMhFtKV3akI8d0bLYmibvPPN3wz00CJxmQnTO41whwWQRIctmEcB6sQbFC3CjW3XW8kxpOpP+OC22d1Wml1qZkQGtoMsScxaczKN3plG8zlaHIta5KqWsozoTYw3/djzwhpLwivWFGHGpAFe7DL68JlBUk+l7KSN7tCOEJ4M3/qOI49vMHj+zCKdlFqLaU2ZHV2a4Ct/an0/ivdX8oYc1UVX860fQDQiMdxRQEAAA=="
  }
}

Related information

Filter pattern syntax for metric filters, subscription filters, filter log events, and Live Tail