AWS Lambda
AWS Lambda allows you to run code without the burden of provisioning or managing servers. The AWS Lambda ULM App is a unified logs and metrics (ULM) app for monitoring operation and performance trends in the Lambda functions in your account.
The AWS Observability Lambda utilizes Lambda Logs and Metrics from CloudWatch, as well as CloudTrail Lambda Data Events. Preconfigured dashboards provide insights into executions, such as memory and duration usage by function versions or aliases, as well as performance metrics such as errors, throttles, invocations, and concurrent executions.
Log and metric types
The AWS Lambda ULM app uses the following logs and metrics:
Sample Log Messages
This section provides sample Amazon CloudWatch Log and CloudTrail Lambda Data Events log messages.
Amazon CloudWatch Log
{"id":"32563142671071560797760688825700039436306340248688066573","timestamp":1511808906799,"message":
"REPORT RequestId: cf75cfa3-fe16-11e5-9b16-e3e4c70845f2 Duration: 50.23 ms Billed Duration:
100 ms Memory Size: 128 MB Max Memory Used: 24 MB ","requestID":null,"logStream"
:"2017/11/27/[Prod]1108153ced144f8cbb161aef096218d1","logGroup":"/aws/lambda/AWSlambda1"}
CloudTrail Lambda Data Events
{
"eventVersion":"1.06",
"userIdentity":{
"type":"IAMUser",
"principalId":"AIDAJ45Q7YFFAREXAMPLE",
"arn":"arn:aws:iam::111111111111:user/duc",
"accountId":"111111111111",
"accessKeyId":"AKIAIOSFODNN7EXAMPLE",
"userName":"duc"
},
"eventTime":"2017-11-27T19:05:20.524Z",
"eventSource":"lambda.amazonaws.com",
"eventName":"Invoke",
"awsRegion":"us-west-1",
"sourceIPAddress":"155.14.186.236",
"userAgent":"aws-cli/1.11.129 Python/2.7.8 botocore/1.5.92",
"requestParameters":{
"invocationType":"RequestResponse",
"functionName":"arn:aws:lambda:us-west-1:111111111111:function:function237",
"clientContext":"ew0KICAiB99udGV6lGtleSIgOiAiY29udGV4dHZhbEXAMPLE=="
},
"responseElements":null,
"additionalEventData":{
"functionVersion":"arn:aws:lambda:us-west-1:111111111111:function:function238:$LATEST"
},
"requestID":"e38fb262-8f45-11e7-9845-e5f2f205b110",
"eventID":"277a6881-66f4-4f3e-ade5-ba76255b7d93",
"readOnly":false,
"resources":[
{
"accountId":"111111111111",
"type":"AWS::Lambda::Function",
"ARN":"arn:aws:lambda:us-west-1:111111111111:function:function239"
}
],
"eventType":"AwsApiCall",
"managementEvent":false,
"recipientAccountId":"111111111111"
}
Query sample
Top Functions by Duration
_sourceCategory=Labs/AWS/Lambda | json "message" | json "logStream", "logGroup" // | _sourceName as logStream | _sourceHost as logGroup | parse regex field=message "REPORT\s+RequestId:\s+(?<RequestId>[^\s]+)\s+Duration:\s+(?<Duration>[^\s]+)\s+ms\s+Billed Duration:\s+(?<BilledDuration>[^\s]+)\s+ms\s+Memory\s+Size:\s+(?<MemorySize>[^\s]+)\s+MB\s+Max\s+Memory\s+Used:\s+(?<MaxMemoryUsed>[^\s]+)\s+MB" | parse field=loggroup "/aws/lambda/*" as functionname | where account matches "*" and region matches "*" and namespace matches "aws/lambda" and functionname matches "*" | sum(Duration) as DurationSum, avg(Duration) as DurationAvg, count as frequency by functionname | top 10 functionname by DurationAvg, DurationSum, frequency