13

I am using CloudWatch log subscription filters stream to Lambda and publish a message to an SNS topic. But it will output garbled message and can't success decode.

my output:

k
%"
 jVbB

If not decode will output like this:

{ "awslogs": {"data": "BASE64ENCODED_GZIP_COMPRESSED_DATA"} }

My code is below and it is using nodejs:

console.log("Loading function");
var AWS = require("aws-sdk");

exports.handler = function(event, context) {
    var eventText = JSON.stringify(event, null, 2);
    var decodeText = new Buffer(eventText, 'base64').toString('ascii');
    console.log("Received event:", eventText);
    var sns = new AWS.SNS();
    var params = {
        Message: decodeText, 
        Subject: "Test SNS From Lambda",
        TopicArn: "arn:aws:sns:region:account:snsTopic"
    };
    sns.publish(params, context.done);
};
Kelvin
  • 165
  • 1
  • 7

1 Answers1

26

CloudWatch Logs are delivered to the subscribed Lambda function as a list that is gzip-compressed and base64-encoded.

Here is an example of how to decode and unzip the list of logs:

const zlib = require('zlib');

exports.handler = async (event, context) => {
  if (event.awslogs && event.awslogs.data) {
    const payload = Buffer.from(event.awslogs.data, 'base64');

    const logevents = JSON.parse(zlib.unzipSync(payload).toString()).logEvents;

    for (const logevent of logevents) {
      const log = JSON.parse(logevent.message);
      console.log(log);
    }
  }
};
jarmod
  • 71,565
  • 16
  • 115
  • 122
  • Hi @jarmod, I am used lambda function for AWS SNS, but we received only message-id & request-id, how to find message have delivered or not – Vishal Sharma Nov 30 '19 at 07:20
  • @VishalSharma When Lambda invokes your function, it passes `event` and `context` objects. The request ID is in `context` and the entire SNS event, including message ID, is in `event`. Print out your entire `event` object. What does it look like? See https://docs.aws.amazon.com/lambda/latest/dg/with-sns.html – jarmod Nov 30 '19 at 13:37