Skip to main content
Sumo Logic

Auto-Subscribe AWS Log Groups to a Lambda Function

Sumo’s LogGroup Lambda Connector automates the process of creating Amazon Cloudwatch Log Group subscriptions.  

You can use the connector with Sumo Lambda functions, available at https://github.com/SumoLogic/sumologic-aws-lambda, or with other Lambda functions of your own.

This page has instructions for configuring and deploying the LogGroup Lambda Connector using a CloudFormation template.

Step 1. Download the CloudFormation template

You can use a Sumo-provided CloudFormation template,loggroup-lambda-cft.json,to automate the deployment of the LogGroup Lambda Connector. The template creates the following resources:

  • PermissionForEventsToInvokeLambda—Permission to CloudTrail events for invoking the Lambda function (SumoLogGroupLambdaConnector).

  • SumoLGCnCreateLogGroupTrigger—A CloudTrail Event Rule which triggers the Lambda function (SumoLogGroupLambdaConnector) on the CreateLogGroup event.

  • SumoLGCnLambdaExecutionRole—An IAM Role for the Lambda function which defines permissions to create subscription filters and CloudWatch logs.

  • SumoLogGroupLambdaConnector—The Lambda function responsible for creating a subscription filter on Log Groups that match specified filter criteria.

Download loggroup-lambda-cft.json.

Step 2. Define environment variables

In this step you define environment variables that specify the destination Lambda function and the Log Groups you want to subscribe to it. You define the variables in theloggroup-lambda-cft.json file that you downloaded in the previous step.

  1. Locate the “Environment” section ofloggroup-lambda-cft.json.
    env-vars.png
  2. The LAMBDA_ARN environment variable defines the Amazon Resource Name (ARN) of the Lambda function. Edit the function attribute In the "LAMBDA_ARN" section, replacing TestLambda with the desired function name.

  3. The LOG_GROUP_PATTERN environment variable is a Javascript regex to filter Log Groups. Log Groups that match the regex will be subscribed to the Lambda function. Matching is case-insensitive. The placeholder regex Test matches testlogroup, logtestgroup, and LogGroupTest.

    ReplaceTestwith the Javascript regex that filters your Log Groups as desired.   

  4. Save the file.

Step 3:  Create a stack

In this step, you create a stack using the AWS CloudFormation console.

  1. Log in to the AWS Management Console.

  2. Under Management Tool, select CloudFormation.

  3. Create a new stack by clicking Create Stack.

  4. In Select Template window, choose Upload a template to Amazon S3 and uploadloggroup-lambda-cft.json.
    select-template.png

  5. Click Next.

  6. Specify a stack name and click Next.

  7. In Options window click Next again.

  8. In Review window click the checkbox acknowledging that you understand this template creates IAM resources and click Create.

  9. After few seconds CREATE_COMPLETE should appear in the Status column.

Step 4: Test the Lambda function

To test the Lambda function

  1. Create a Log Group with a name that matches the regex you specified for LOG_GROUP_PATTERN.
    test1.png
  2. After a few seconds, the Log Group should be subscribed to the Lambda function whose ARN you specified in the LAMBDA_ARN environment variable.
    test2.png