Node/JavaScript while parsing AWS CloudWatch logs - Incorrect Header Check - Z_DATA_ERROR

Question

I'm trying to set up a Lambda function in AWS to send some logs from CloudWatch down to a Slack channel. I've found a number of tutorials on doing this, but am getting an error when invoking the JavaScript code. Here's the code:

const https = require('https');
const zlib  = require('zlib');

exports.handler = async (event, context) => {
    try {
      const payload       = Buffer.from(event.awslogs.data, 'base64');
      console.log('payload:', payload);
      const parsedPayload = JSON.parse(zlib.gunzipSync(payload).toString('utf8'));
      console.log('parsedPayload:', parsedPayload);
      const logEvents     = parsedPayload.logEvents;

      let cwlErrorMessage = '';
      for (let logEvent of logEvents) {
        cwlErrorMessage += logEvent.message + "\n";
      }

      let userAccountNotification = {
        'username': 'someUser',
        'blocks': [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": cwlErrorMessage.replace(/"/g, 'Bug!')
            }
          }
        ],
      };
        
      await sendSlackMessage(userAccountNotification);
      
      return `Successfully processed ${parsedPayload.logEvents.length} log events.`;
        
    } catch(error) {
        console.error('Stg CloudWatch Error Alarm: error sending slack notification ', error);
    }
};

const sendSlackMessage = (messageBody) => {
  return new Promise((resolve, reject) => {
    
    const requestOptions = {
      method: 'POST',
      header: {
        'Content-Type': 'application/json'
      }
    };

    const req = https.request('myurl', requestOptions, (res) => {
      let response = '';

      res.on('data', (d) => {
        response += d;
      });

      res.on('end', () => {
        resolve(response);
      })
    });

    req.on('error', (e) => {
      reject(e);
    });

    req.write(JSON.stringify(messageBody));
    req.end();
  });
};

And here's the error I'm receiving:

INFO    payload: payload: <Buffer 11 14 4e 46 a0 90 04 21 97 d1 79 bb 10 5b 4a fa c9 99 04 45 20 5e 82 c2 74 c8 45 b4 a5 77 6a 42 3c 77 46 cb 62 68 9b bc f3 cd df 0c f4 d0 22 71 99 09 ... 148 more bytes>
ERROR   Stg CloudWatch Error Alarm: error sending slack notification  Error: incorrect header check
    at Zlib.zlibOnError [as onerror] (node:zlib:189:17)
    at processChunkSync (node:zlib:455:12)
    at zlibBufferSync (node:zlib:178:12)
    at Object.syncBufferWrapper [as gunzipSync] (node:zlib:790:14)
    at Runtime.exports.handler (/var/task/index.js:11:45)
    at Runtime.handleOnce (file:///var/runtime/index.mjs:548:29) {
  errno: -3,
  code: 'Z_DATA_ERROR'
}

(In full disclosure, I pulled the code from this site.)

You can see from the log that the payload exists as a Buffer, and then appears to error out on this line:

const parsedPayload = JSON.parse(zlib.gunzipSync(payload).toString('utf8'));

I've looked at similar SO questions, but they haven't helped with this exact issue.

Any help would be greatly appreciated; thanks!

You went and redacted the useful part of your output, which is the buffer contents. Please update your question with the full output. — Mark Adler, Jul 16 '22 at 00:01
My apologies; I didn't realize that was important (obviously). I added it in now; thanks! — risingTide, Jul 16 '22 at 02:17

Mark Adler · Accepted Answer · 2022-07-16T02:27:08.907

1

The 50 bytes of data you provided does not have any deflate compressed streams in it, which is what would be found in either a gzip or a zlib stream.

edited Jul 16 '22 at 02:27

answered Jul 16 '22 at 00:04

Mark Adler

101,978
13
118
158

For learnings purposes, how did you know that? – risingTide Jul 19 '22 at 20:56
1

I have code that searches for deflate streams. – Mark Adler Jul 20 '22 at 05:55

Node/JavaScript while parsing AWS CloudWatch logs - Incorrect Header Check - Z_DATA_ERROR

1 Answers1