AWS CloudWatch
You can forward Cloud watch logs to Apica Ascent using 2 methods.
Apica Ascent CloudWatch exporter Lambda function
Run Logstash on VM (or docker)
Apica Ascent CloudWatch exporter Lambda function
You can export AWS CloudWatch logs to Apica Ascent using an AWS Lambada function. The AWS Lambda function acts as a trigger for a CloudWatch log stream.
This guide explains the process for setting up an AWS Lambda function and configuring an AWS CloudWatch trigger to forward CloudWatch logs to Apica Ascent.
Creating a Lambda function
Apica Ascent provides CloudFormation templates to create the Apica Ascent CloudWatch exporter Lambda function.
Depending on the type of logs you'd like to export, use the appropriate CloudFormation template from the following list.
Exporting Lambda Function logs
Use the following CloudFormation template to export AWS Lambda function logs to Apica Ascent.
Exporting CloudTrail Logs
Use the following CloudFormation template to export CloudTrail logs to Apica Ascent.
Exporting AWS VPC Flowlogs
Use the following CloudFormation template to export Flowlogs logs to Apica Ascent.
Exporting Cloudwatch logs from other services
Use the following CloudFormation template to export cloudwatch logs.
This CloudFormation stack creates a Lambda function and its necessary permissions. You must configure the following attributes.
Configuring the CloudWatch trigger
Once the CloudFormation stack is created, navigate to the AWS Lambda function (logiq-cloudwatch-exporter
) and add a trigger.
On the Add trigger page, select CloudWatch, and then select a CloudWatch Logs Log Group.
Once this configuration is complete, any new logs coming to the configured CloudWatch Log group will be streamed to the Apica Ascent cluster.
Create the Logstash VM (or Docker)
Install Logstash on Ubuntu virtual machine as shown below.
Configure Logstash
Logstash comes with no default configuration. Create a new file /etc/logstash/conf.d/logstash.conf
with these contents, modifying values as needed:
You need to download and place the FlattenJSON.rb file in your local before you run the Logstash
You can obtain an ingest token from the Apica Ascent UI as described here. You can customize the namespace
and cluster_id
in the Logstash configuration based on your needs.
Your AWS Cloud watch logs will now be forwarded to your Apica Ascent instance. See the Explore Section to view the logs.
Last updated