Surely, you’ve been there many times. Just wanted to browse some logs from your ECS task, Lambda function, or any other AWS service. And you found yourself in front of CloudWatch’s Console UI, angrily mumbling about the poor usability.

Let this just be a memory of the past by starting to use Jorge Bastida’s AWS CloudWatch logs for Humans and finally enjoy browsing your logs from your local terminal.

Install this great package either via pip (pip install awslogs) or Homebrew (brew install awslogs) and let me get you started with its awesomeness.

Browsing & finding your log groups

For me, it’s always difficult to even find my target log group, as I’m having a lot of functions, different stages, and environments — sometimes multiple CloudFormation clusters for the same service. With awslogs groups I’m easily able to list & filter my log groups on what I really want.

• awslogs groups --aws-region=eu-central-1 — listing log groups for eu-central-1.

• awslogs groups | grep ‘myfunction' — only showing log groups for groups containing the name myfunction.

Streaming logs to your terminal

Browsing logs in the AWS Console is no fun. You’re only able to load a certain amount of logs and each scroll to the end will load the next batch. Especially if you’re writing lots of logs, you’ll have a painful time. Let’s use awslogs get.

• awslogs get /aws/lambda/myfunction — displaying the last logs of our target service.

• awslogs get /aws/lambda/myfunction --watch — starting a continuous stream of our logs to our terminal, so new logs will be shown after they are received by CloudWatch.

• awslogs get /aws/lambda/myfunction --start='15m ago' — receives the last 15 minutes of our log stream. Additionally, you can also provide end, use timestamps like 22/1/2021 or 22/1/2021 12:00 and even more.

Filtering logs

You're also able to filter your logs by using filter_pattern as well as only returning certain fields if you logging JSON by using query.

• awslogs get /aws/lambda/myfunction --filter-pattern='{ $.upstream_status = 502 }’ — just receiving logs from Lambda with JSON field upstream_status set to 502.

• awslogs get /aws/lambda/myfunction --query=logMessage — only displaying the field logMessage of the JSON log.

I really like to put effort into making it as useful for my daily business as possible by removing noise. For me, working heavily with NestJS and Lambda, also forwarding instrumentation logs to NewRelic, I don’t want to see a lot of stuff:

• Cryptic instrumentation logs by the NewRelic agent.

• Start & end messages by the Lambda instance itself.

• Nest initialization messages.

This leads me to regularly use something like this:

awslogs get /aws/lambda/myfunction --watch \  
 --start='10m ago' \  
 --query=logMessage \  
 --filter-pattern='-"NR_LAMBDA_MONITORING" -"START " -"END " -"REPORT " -"[Nest] 8"-"Server initialized "'

Final thoughts

Personally, this small little tool is almost a game-changer for productivity at working with AWS — especially if you’re not using an advanced product where you can easily browse, search and correlate your logs.

Check out our overall guide for CloudWatch here.

Thanks to Jorge Bastida & all the other contributors! 👏