Easily retrieve CloudWatch logs from the CLI with awslogs
Learn how to efficiently retrieve and analyze AWS CloudWatch logs using the awslogs CLI tool, a powerful alternative to navigating the AWS Console. You'll work with a Lambda function that generates errors, learning to discover AWS resources, configure the awslogs tool with lab-provided credentials, and practice using various filtering techniques including time-based filters, content searches, and CloudWatch filter patterns. Through a practical troubleshooting scenario, you'll dramatically improve your debugging workflow when working with CloudWatch logs across multiple log streams, services, and AWS accounts.
- 13 guided tasks
- Capture the flag
- Terminal in the browser
Scenario
Your lab account has a Lambda function named broken-lambda-for-awslogs-demo that fails each time it runs. Finding the cause in the CloudWatch console is slow. In this lab, you install the awslogs CLI tool, run the function to create error logs, and filter those logs from your terminal until you find the error message to submit as the flag.
The need to quickly retrieve, filter, and analyze logs is super important. If you've ever tried to debug an issue using the CloudWatch console, you know how cumbersome it can be to navigate through the UI, especially when you're looking for specific information across multiple log streams.
CloudWatch Logs is great for centralized logging, but when it comes to actually working with those logs, the AWS Console experience can be:
- Slow to load and navigate
- Difficult to filter effectively
- Not easily integrated into your CLI workflow
- Challenging when working with multiple log streams
The `aws logs` commands in the official AWS CLI are functional but quite verbose and not optimized for common debugging workflows. I've personally never liked using that particular CLI.
That's where `awslogs` comes in - it's a simple yet powerful command-line tool that makes retrieving CloudWatch logs from your terminal a breeze.
awslogs is an open-source CLI tool that wraps the AWS API for CloudWatch Logs with a more user-friendly interface. It lets you retrieve log events from CloudWatch Logs with a simple, grep-like interface directly from your terminal.
A quick word of warning: the tool hasn't been updated in a year and has quite a few open issues and pull requests, so it looks like it might be abandoned. It still works fine and I personally use it, but keep this in mind.
What you will learn
- Install the awslogs CLI tool in a Python virtual environment
- Invoke a Lambda function to create error logs in CloudWatch Logs
- Retrieve log events from a log group with awslogs
- Filter log events by time, with grep, and with CloudWatch filter patterns
- Watch a log group in real time and find the cause of a Lambda error
Easily retrieve CloudWatch logs from the CLI with awslogs
Included in Cybr Premium.