AWS Elastic Beanstalk: Add custom logs to CloudWatch?

Question

How to add custom logs to CloudWatch? Defaults logs are sent but how to add a custom one?

I already added a file like this: (in .ebextensions)

files:
  "/opt/elasticbeanstalk/tasks/bundlelogs.d/applogs.conf" :
    mode: "000755"
    owner: root
    group: root
    content: |
      /var/app/current/logs/*

  "/opt/elasticbeanstalk/tasks/taillogs.d/cloud-init.conf" :
    mode: "000755"
    owner: root
    group: root
    content: |
      /var/app/current/logs/*

As I did bundlelogs.d and taillogs.d these custom logs are now tailed or retrieved from the console or web, that's nice but they don't persist and are not sent on CloudWatch.

In CloudWatch I have the defaults logs like
/aws/elasticbeanstalk/InstanceName/var/log/eb-activity.log
And I want to have another one like this
/aws/elasticbeanstalk/InstanceName/var/app/current/logs/mycustomlog.log

Solution 1

Both bundlelogs.d and taillogs.d are logs retrieved from management console. What you want to do is extend default logs (e.g. eb-activity.log) to CloudWatch Logs. In order to extend the log stream, you need to add another configuration under /etc/awslogs/config/. The configuration should follow the Agent Configuration file Format.

I've successfully extended my logs for my custom ubuntu/nginx/php platform. Here is my extension file FYI. Here is an official sample FYI.

In your case, it could be like

files:
  "/etc/awslogs/config/my_app_log.conf" :
    mode: "000600"
    owner: root
    group: root
    content: |
      [/var/app/current/logs/xxx.log]
      log_group_name = `{"Fn::Join":["/", ["/aws/elasticbeanstalk", { "Ref":"AWSEBEnvironmentName" }, "var/app/current/logs/xxx.log"]]}`
      log_stream_name = {instance_id}
      file = /var/app/current/logs/xxx.log*

Solution 2

Credits where due go to Sebastian Hsu and Abhyudit Jain.

This is the final config file I came up with for .ebextensions for our particular use case. Notes explaining some aspects are below the code block.

files:
  "/etc/awslogs/config/beanstalklogs_custom.conf" :
    mode: "000600"
    owner: root
    group: root
    content: |
      [/var/log/tomcat8/catalina.out]
      log_group_name = `{"Fn::Join":["/", ["/aws/elasticbeanstalk", { "Fn::Select" : [ "1", { "Fn::Split" : [ "-", { "Ref":"AWSEBEnvironmentName" } ] } ] }, "var/log/tomcat8/catalina.out"]]}`
      log_stream_name = `{"Fn::Join":["--", [{ "Ref":"AWSEBEnvironmentName" }, "{instance_id}"]]}`
      file = /var/log/tomcat8/catalina.out*

services:
  sysvinit:
    awslogs:
      files:
        - "/etc/awslogs/config/beanstalklogs_custom.conf"

commands:
  rm_beanstalklogs_custom_bak:
    command: "rm beanstalklogs_custom.conf.bak"
    cwd: "/etc/awslogs/config"
    ignoreErrors: true

log_group_name

We have a standard naming scheme for our EB environments which is exactly environmentName-environmentType. I'm using { "Fn::Split" : [ "-", { "Ref":"AWSEBEnvironmentName" } ] } to split that into an array of two strings (name and type).

Then I use { "Fn::Select" : [ "1", <<SPLIT_OUTPUT>> ] } to get just the type string. Your needs would obviously differ, so you may only need the following:

      log_group_name = `{"Fn::Join":["/", ["/aws/elasticbeanstalk", { "Ref":"AWSEBEnvironmentName" }, "var/log/tomcat8/catalina.out"]]}`

log_stream_name

I'm using the Fn::Join function to join the EB environment name with the instance ID. Note that the instance ID template is a string that gets echoed exactly as given.

services

The awslogs service is restarted automatically when the custom conf file is deployed.

commands

When the files block overwrites an existing file, it creates a backup file, like beanstalklogs_custom.conf.bak. This block erases that backup file because awslogs service reads both files, potentially causing conflict.

Result

If you log in to an EC2 instance and sudo cat the file, you should see something like this. Note that all the Fn functions have resolved. If you find that an Fn function didn't resolve, check it for syntax errors.

[/var/log/tomcat8/catalina.out]
log_group_name = /aws/elasticbeanstalk/environmentType/var/log/tomcat8/catalina.out
log_stream_name = environmentName-environmentType--{instance_id}
file = /var/log/tomcat8/catalina.out*

Solution 3

The awslogs agent looks in the configuration file for the log files which it's supposed to send. There are some defaults in it. You need to edit it and specify the files.

You can check and edit the configuration file located at:

/etc/awslogs/awslogs.conf

Make sure to restart the service:

sudo service awslogs restart

You can specify your own files there and create different groups and what not.

Please refer to the following link and you'll be able to get your logs in no time.

Resources:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html

Edit:

As you don't want to edit the files on the instance, you can add the relevant code to the .ebextensions folder in the root of your code. For example, this is my 01_cloudwatch.config :

packages:
  yum:
    awslogs: []

container_commands:
  01_get_awscli_conf_file:
    command: "aws s3 cp s3://project/awscli.conf /etc/awslogs/awscli.conf"
  02_get_awslogs_conf_file:
    command: "aws s3 cp s3://project/awslogs.conf.${NODE_ENV} /etc/awslogs/awslogs.conf"
  03_restart_awslogs:
    command: "sudo service awslogs restart"
  04_start_awslogs_at_system_boot:
    command: "sudo chkconfig awslogs on"

In this config, I am fetching the appropriate config file from a S3 bucket depending on the NODE_ENV. You can do anything you want in your config.

Solution 4

Some great answers already here.

I've detailed in a new Medium blog how this all works and an example .ebextensions file and where to put it.

Below is an excerpt that you might be able to use, the article explains how to determine the right folder/file(s) to stream.

Note that if /var/app/current/logs/* contains many different files this may not work,e.g. if you have

database.log app.log random.log

Then you should consider adding a stream for each, however if you have

app.2021-10-18.log app.2021-10-17.log app.2021-10-16.log

Then you can use /var/app/current/logs/app.*

packages:
  yum:
    awslogs: []

option_settings:
  - namespace: aws:elasticbeanstalk:cloudwatch:logs
    option_name: StreamLogs
    value: true
  - namespace: aws:elasticbeanstalk:cloudwatch:logs
    option_name: DeleteOnTerminate
    value: false
  - namespace: aws:elasticbeanstalk:cloudwatch:logs
    option_name: RetentionInDays
    value: 90

files:
  "/etc/awslogs/awscli.conf" :
    mode: "000600"
    owner: root
    group: root
    content: |
      [plugins]
      cwlogs = cwlogs
      [default]
      region = `{"Ref":"AWS::Region"}`

  "/etc/awslogs/config/logs.conf" :
    mode: "000600"
    owner: root
    group: root
    content: |
      [/var/app/current/logs]
      log_group_name = `{"Fn::Join":["/", ["/aws/elasticbeanstalk", { "Ref":"AWSEBEnvironmentName" }, "/var/app/current/logs"]]}`
      log_stream_name = {instance_id}
      file = /var/app/current/logs/*

commands:
  "01":
    command: systemctl enable awslogsd.service
  "02":
    command: systemctl restart awslogsd

View more solutions

Comments

[Joël]

Thanks you Abhyudit, but as it's an Elastic Beanstalk Instance editing the files directly is not something I can do... The instances can be deleted / replaced at anytime!

[Abhyudit Jain]

@Joël You don't have to edit files on the instance. You have to add these commands to .ebextensions and whenever the code is deployed, it will take care of that. See the edit.

[Joël]

This looks like what I need! Thank you Sebastian!

[Torsten Engelbrecht]

So far I got no luck with this. I compared it with the existing config files already deployed on the EB instance and it looks exactly the same (except for the log paths), so I assume it actually should work. How was your success rate with with @Joël ? Did it work for you?

[Joël]

@TorstenEngelbrecht So I had to "Rebuild" the instance at one moment and it worked after that if I remember well.

[Torsten Engelbrecht]

@Joël Thanks. This still did not work for me, but I figured out a way to make this work later. I had to attach or extend the policies for the Elastic Beanstalk service role (instance profile) to add more permissions to handle CloudWatch logs. After that they magically appeared in Cloudwatch.

[ADTC]

Can you explain your complex function for log_group_name? (found some documentation). And please tell me whether the part { "Ref":"AWSEBEnvironmentName" } can somehow be used in the log_stream_name which is what I need to do. What other "Ref" values are possible?

[ADTC]

I have answered my own question about log_stream_name. I have posted an answer as well :)

[ADTC]

Sidenote: You can use AWS CLI along with a little utility called cwtail to tail the collected logs.

[Arun]

I followed the same steps and reused the code mention in your answer but I couldn't find the file beanstalklogs_custom.conf under /etc/awslogs/config. The .ebextensions folder in my root of the war file. eb activity logs doesnt show any error. is there anything specific to be checked?

[Arun]

@TorstenEngelbrecht can you let know the policies you attached to the Elastic Beanstalk service role. I am facing the same issue as yours.

[Torsten Engelbrecht]

@Arun I think this link covers the policy to use: docs.aws.amazon.com/elasticbeanstalk/latest/dg/….

[jrey]

Thanks Guys, I got adding CloudWatchLogsFullAccess to my role

[Chris Prince]

It seems like the prefix "/etc/awslogs/config" is important to getting the log to show up in CloudWatch.

[Merricat]

Thank you for pointing out the backup file, this problem was driving me nuts!!! EB kept using the configuration from the backup instead of the normal one, so it was always using the 'previous build' one.

[user304966]

Will awslogs know to use the file "beanstalklogs_custom.conf" rather than "beanstalklogs.conf"? Or will it read both?

[pba]

awslogs troubleshooting doc can be useful: aws.amazon.com/premiumsupport/knowledge-center/… Especially looking at /var/log/awslogs.log. In my case the CreateLogGroup permission was missing, which is not part of docs.aws.amazon.com/elasticbeanstalk/latest/dg/…