CloudWatch log multiple custom metric filters to trigger lambda function

Question

I just start learning on aws, and I have created couple of cloudwatch log custom metric filter and subscribe to the same lambda function do to some stuff, but I want to get my lambda function to perform difference action depends on which metric filter trigger it. In the lambda function(in python) how can I know which metric filter trigger it?

Answer 1

In Lambda function handlers, you'll have an event object, this object will usually contain information about the request. According to the documentation, this is base64 encoded and zipped. I imagine this is because the logs are expected to get fairly large.

Once unzipped the structure is:

{ messageType: 'DATA_MESSAGE',
  owner: '123456789123',
  logGroup: 'testLogGroup',
  logStream: 'testLogStream',
  subscriptionFilters: [ 'testFilter' ],
  logEvents: 
   [ { id: 'eventId1',
       timestamp: 1440442987000,
       message: '[ERROR] First test message' },
     { id: 'eventId2',
       timestamp: 1440442987001,
       message: '[ERROR] Second test message' } ] }

This can be found in the AWS docs under CloudWatch Logs.

You can check on the subscriptionFilters field in the event data to check which filter triggered the Lambda.

If your Lambda was in NodeJS, you could write something like the following:

const zlib = require('zlib');
const YOUR_FILTER = 'filter1';

exports.handler = async (event) => {
    const zippedInput = new Buffer(event.awslogs.data, 'base64');
    await new Promise((resolve, reject) => {
        zlib.gunzip(zippedInput, function (e, buffer) {
            const awslogsData = JSON.parse(buffer.toString('utf-8'));
            // Conditions on filters to do something
            if (awslogsData.subscriptionFilters.includes(YOUR_FILTER)) {
                // do something
            } else if (awslogsData.subscriptionFilters.includes('your_other_filter')) {
                // do something else
            }

            resolve();
        });
    })

    return 'Hello from Lambda!'
};