Alerts based on Application error logs from AWS Cloudwatch log groups

Question

I have an Ruby on Rails application running inside AWS EC2, which pushes all the application logs to cloudwatchlog groups. the task now is to get an alerts daily from the cloudwatch logs reporting how many error codes are produced in a day.

example:

if my application is giving 10 "500 internal server errors", 5 "403 forbidden errors". I should get an email from AWS services that, "your application generated 10 - 500 error codes 5 - 403 error codes."

I think we can achieve this with a lambda function and AWS SNS service, but dont know how to code my lambda function to work in this manner.

I need a lambda function code to store the error code counts , After capturing the data i can run lambda function daily at a specific time to send an email.

kindly help.

Thanks in Advance:)

Answer 1

What kind of load balancer do you have in front of the EC2; if any?

Cloudwatch already contains the below metrics for a load balancer:

HTTPCode_Target_2XX_Count, HTTPCode_Target_3XX_Count, HTTPCode_Target_4XX_Count, HTTPCode_Target_5XX_Count See - https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html

Requesting those metrics might be easier than parsing your application log files and counting the results.

To request those stats using the aws-sdk for ruby the below code should get you most of the way. You will need to adapt it to your needs and setup, so see the docs I've linked at the bottom of the answer:

metric = Aws::CloudWatch::Metric.new 'AWS/ApplicationELB', 'HTTPCode_ELB_4XX_Count'

stats = metric.get_statistics({
  dimensions: [
    {
      name: "LoadBalancerName",
      value: "'YOUR_ALB_NAME'",
    },
  ],
  start_time: Time.now - 3600 * 24 * 30,
  end_time: Time.now,
  period: 3600 * 24 * 30,
  unit: "Seconds", # accepts Seconds, Microseconds, Milliseconds, Bytes, Kilobytes, Megabytes, Gigabytes, Terabytes, Bits, Kilobits, Megabits, Gigabits, Terabits, Percent, Count, Bytes/Second, Kilobytes/Second, Megabytes/Second, Gigabytes/Second, Terabytes/Second, Bits/Second, Kilobits/Second, Megabits/Second, Gigabits/Second, Terabits/Second, Count/Second, None
  statistics: ["Average"], # accepts SampleCount, Average, Sum, Minimum, Maximum
})

See https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-cloudwatch-metrics.html for details on the stats you can request

and https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CloudWatch/Metric.html for use of the ruby SDK

You can also dashboard these metrics if you go to the AWS dashboard, and you should probably start with this to get a feel for some of the params you use in your SDK call.

1. Go to the Cloudwatch service in your AWS dashboard
2. Select Metrics from the left
3. Select ELB from the AWS namespaces section
4. Select by namespace to get all load balancer info at the same time, or select by load balancer to narrow your metrics display.
5. Select the status code you want to visualise.

This is how to get the count of status codes, and could form the basis of a ruby lambda function which can run every 30 days. How to then email that to yourself could be a whole question unto itself but there are plenty of tutorials online for how to send email with Ruby - start there.