Centralised logging for AWS Lambda, REVISED (2018)

First of all, I would like to thank all of you for following and reading my content. My post on has been viewed more than 20K times by now, so it is clearly a challenge that many of you have run into. centralised logging for AWS Lambda In the post, I outlined an approach of using a Lambda function to ship all your Lambda logs from CloudWatch Logs to a log aggregation service such as . Logz.io In the , I also included functions to: demo project auto-subscribe new log groups to the log-shipping function auto-update the retention policy of new log groups to X number of days (default is which has a long term cost impact) Never Expire This approach works well when you start out. However, you can run into some serious problems at scale. Mind the concurrency When processing CloudWatch Logs with a Lambda function, you need to be mindful of the no. of concurrent executions it creates. Because CloudWatch Logs is an asynchronous event source for Lambda. When you have 100 functions running concurrently, they will each push logs to CloudWatch Logs. This in turn can trigger 100 concurrent executions of the log shipping function. Which can potentially double the number of functions that are concurrently running in your region. Remember, there is a soft, limit of for all functions! regional 1000 concurrent executions This means your log shipping function can cause throughout your entire application. Critical functions can be throttled because too many executions are used to push logs out of CloudWatch Logs — not a good way to go down ;-) cascade failures You can set the Reserved Concurrency for the log shipping function, to limit its max number of concurrent executions. However, you risk losing logs when the log shipping function is throttled. You can also request a raise to the regional limit and make it so high that you don’t have to worry about throttling. A better approach at scale is to use Kinesis However, I would suggest that a better approach is to stream the logs from CloudWatch Logs to a Kinesis stream first. From there, a Lambda function can process the logs and forward them on to a log aggregation service. With this approach, you have control the concurrency of the log shipping function. As the number of log events increases, you can increase the number of shards in the Kinesis stream. This would also increase the number of concurrent executions of the log shipping function. Take a look at this to see how it works. It has a nearly identical set up to the demo project for the : repo previous post a function that automatically updates the retention policy for new log groups to 7 days set-retention a function automatically subscribes new log groups to a Kinesis stream subscribe a function that processes the log events from the above Kinesis stream and ships them to ship-logs-to-logzio Logz.io a script to subscribe all existing log groups to the same Kinesis stream process_all You should also check out to see how you can autoscale Kinesis streams using CloudWatch and Lambda. this post Hi, my name is . I’m an and the author of . I have run production workload at scale in AWS for nearly 10 years and I have been an architect or principal engineer with a variety of industries ranging from banking, e-commerce, sports streaming to mobile gaming. I currently work as an independent consultant focused on AWS and serverless. Yan Cui AWS Serverless Hero Production-Ready Serverless You can contact me via , and . Email Twitter LinkedIn Check out my new course, . Complete Guide to AWS Step Functions In this course, we’ll cover everything you need to know to use AWS Step Functions service effectively. Including basic concepts, HTTP and event triggers, activities, design patterns and best practices. Get your copy . here Come learn about operational for AWS Lambda: CI/CD, testing & debugging functions locally, logging, monitoring, distributed tracing, canary deployments, config management, authentication & authorization, VPC, security, error handling, and more. BEST PRACTICES You can also get off the face price with the code . 40% ytcui Get your copy . here