Sending cloudwatch email from logs

Question

I am using an EC2 instance. I have logged the exceptions in my applications to cloudwatch logs. Format of log is a JSON object/string:

{
'application': 'abc',
'type': '404',
'error': 'The page you requested was not found.'
}

Now i want to email specific logs on an email address on the basis of log type for eg: just the logs with type 404. How can i achieve this?

Answer 1

I did not see SNS as a subscription to log group, but you can do this using Lambda function.

When the log match, trigger the lambda and from lambda, you can send an email or can perform any action based on the message.

Add filter on subscription.

aws logs put-subscription-filter --log-group-name /aws/ec2/execption --destination-arn arn:aws:lambda:us-east-1:123456:function:send-email-on-exception --filter-name ec2-404-errors --filter-pattern "404"

Filter and Pattern Syntax

You can use metric filters to search for and match terms, phrases, or values in your log events. When a metric filter finds one of the terms, phrases, or values in your log events, you can increment the value of a CloudWatch metric. For example, you can create a metric filter to search for and count the occurrence of the word ERROR in your log events.

FilterAndPatternSyntax

You can explore this article to read the aws CW log event.