Can I use CloudWatch Logs to trigger a Lambda function?

Question

I'm working on a POC where I want to use the Amazon CloudWatch Logs (custom logs generated from the Amazon EC2 Instance) to trigger an AWS Lambda function based on a certain output is captured in the CloudWatch Logs.
Is it possible to trigger Lambda based on CloudWatch Logs? If it's possible, provide me with the relevant documentation /procedure.

**Example:**
Custom logs captured in  the CloudWatch Log stream are similar to the following:

ASCS Node: TRUE		ASCS Status: Running
            ASCS Node: TRUE		ASCS Status: Running
            ASCS Node: TRUE		ASCS Status: Running

I want to trigger a Lambda function when the following condition is true:

ASCS Node: TRUE		ASCS Status: **Stopped**

Accepted Answer

It's possible to trigger a Lambda from based on a matching pattern in the CloudWatch Logs. Instead of using the CloudWatch Logs subscription filters, do the following:

1. **Create metric filter** from your **Log group**. For **Filter Pattern**, enter the pattern that you want to capture (in your sample : `Status: **Stopped**`). For more information, see [Publishing numerical values found in log entries][1].
2. Create an Amazon SNS topic and integrate your Lambda function there. For more information, see [Tutorial: Using AWS Lambda with Amazon Simple Notification Service][2].
3. Create CloudWatch Alarm to monitor the metric you created in step #1. For more information, see [Create a CloudWatch alarm based on a static threshold][3].

Keep the following in mind when defining the alarm:
 - For **Period**, select a sufficient time range (Example: 10 seconds).
 - For **Statistic**, select **Sum**.
 - For **Threshold type**, select **Static**.
 - For **Define the alarm condition**, select **Greater > threshold**.
 - For **Define the threshold value**, select **0**
- Configure the alarm's action as the SNS topic you created earlier.

[1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html#publishing-values-found-in-logs
[2]: https://docs.aws.amazon.com/lambda/latest/dg/with-sns-example.html
[3]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ConsoleAlarms.html

Can I use CloudWatch Logs to trigger a Lambda function?

Relevant content