AWS CloudWatch Logs

Send AWS CloudWatch Logs to Timber

Timber integrates with AWS CloudWatch Logs through its lambda subscription feature, making it easy to forward CloudWatch logs to Timber while capturing useful context along the way.

Installation

AWS Console
Terraform
  1. First, deploy Timber's Lambda function to forward your logs:

    1. In the "Application Settings" panel, enter your Timber source ID and Timber API key.

    2. Click the "Deploy" button.

  2. Next, select the CloudWatch log group that you'd like to forward:

    1. Select the desired CloudWatch log group with the radio button.

    2. Click the "Actions" menu at the top and select "Stream to AWS Lambda"

    3. For the "Lambda Function" field, select the serverless-repo-timber-loggin-... function that you deployed above. Click "Next".

    4. For the "Log Format" field, select "other" and leave the rest of the fields blank. Click "Next".

    5. Review the details and click "Start Streaming".

  3. Head back to the Timber web app and click "Next Step" to verify log delivery.

  4. Repeat this process for any other CloudWatch log groups you wish to forward.

Test The Pipes

You can test the pipes to verify log delivery.

  1. Open the Timber lambda function, it should start with serverless-repo-timber-loggin-....

  2. Click the "Test" button in the top right. A modal will open to create a new test event.

  3. For the "Event template" select "Amazon Cloudwatch Logs".

  4. For the "Event name" enter "Amazon Cloudwatch Logs".

  5. Click "Create".

  6. Click the "Test" button again to test with the new event.

  7. Verify delivery with the log output below.

If you're using Terraform, Timber provides a Terraform module that make provisioning all of the AWS resources easy:

  1. Define the Terraform module in your project, replacing YOUR_API_KEY and YOUR_SOURCE_ID appropriately:

    module "timber_log_forwarding" {
    source = "git::git@github.com:timberio/timber-cloudwatch-logs-lambda-function.git//terraform"
    enable_logging = "false"
    log_group_names = [
    "aws/lambda/hello_world"
    ]
    ‚Äč
    # Obtain both of these at https://app.timber.io
    api_key = "YOUR_API_KEY"
    source_id = "YOUR_SOURCE_ID"
    }
  2. Run terraform init

  3. Then terraform plan and terraform apply as usual.

Multiple Sources

Many of our customers like to define individual Timber sources for each lambda function. If you're one of these customers simply define the Terraform module multiple times with the appropriate source_id for each.

Automatic Context

The timber-logging Lambda function automatically adds context to your logs, helping you to search and use your logs. The following is merged into every log line shipped to Timber:

{
"context": {
"cloudwatch": {
"log_group": "string",
"log_stream": "string",
"owner": "string"
}
}
}

Field

Description

context.cloudwatch.log_group

The log group name of the originating data.

context.cloudwatch.log_stream

The log stream name of the originating log data.

context.cloudwatch.owner

The AWS account ID of the originating log data.

FAQs

Is it possible to automatically forward all CloudWatch logs to Timber?

Unfortunately, AWS requires an individual log subscription for each CloudWatch Logs group. Fortunately, infrastructure management tools like Terraform make this process much easier, and we highly recommending adopting one if possible.

How do I filter log messages sent to Timber?

AWS provide log subscription filters that make this process easy.

Troubleshooting

To begin, please see our log delivery troubleshooting guide. This covers the most common issues we see with log delivery:

If the above troubleshooting guide does not resolve your issue we recommend enabling debug logging on the Timber Lambda forwarder function. You can do this by setting the TIMBER_DEBUG environment variable to true . The the Timber logging function will begin emitting debug logs which you can analyze in the AWS CloudWatch Logs console.