TylerBrock / saw

Fast, multi-purpose tool for AWS CloudWatch Logs
MIT License
1.41k stars 79 forks source link

watch multiple log groups at once #9

Open iDVB opened 6 years ago

iDVB commented 6 years ago

Debugging Lambda@Edge functions can be fun since the function logs are in the CloudWatch region or the edge location. Meaning... if you need to properly debug... you need to ensure you are see ALL the logs for all regions and not just the region you are in.

TylerBrock commented 6 years ago

Interesting. Thank you.

We use lambda@edge at @HustleInc but hadn't run into a use case where we needed to merge log streams from different regions. I think that may be because we only have viewer-request + viewer-response lambdas (between the client and the cache, not between the cache and the origin) so it's always clear from just the lambda@edge logs what is happening in our case.

Would running two instances of saw in different terminal windows work for you if we resolved #11 or is merging them in one instance of saw's output what you are really after to make the tool useful for you in this case?

iDVB commented 6 years ago

@TylerBrock Actually, it's less do to the CF event used and more to do with how Lambda@Edge logging works.

You're logs will always go to the region you edge location, that executed that function, is in.

So if you run a test from Germany... you logs will be under the EU (Frankfurt) Region. Alternatively, if you run a test from Toronto, ON... you're logs don't go to Canada (Central) and instead go to USEast (Ohio) .

The key point here being that unless you're sure where your logs are going.... you tend to have to run around checking all the regions. When you sit between two regions, you can even get bouncing back and forth between tests. This is also not great when you are running multi-region tests.

So it would be REALLY great is there was a CloudWatch logger that would tail on multiple regions at once.

Multiple regions of the same function, mind you. The real benefit is if the logger would only ask for the main function name, and have a flag for logging cross region/replicas. Otherwise, if I have to list out all the streams and the logger just merges them.... its likely not much more help then if I just do that myself and run the logger at once for each region in bash.

udondan commented 5 years ago

I wanted to watch the logs of all components of my application, to see its interaction. API-Gateway -> Lambda -> ECS container. All have different log groups.

Here is my hack using xargs to watch multiple groups with saw:

printf "GroupA\n/GroupB\n/GroupC\n" | xargs -n 1 -P 20 saw watch --raw

If you're using aws-okta you'll need to wrap it in a sh -c or you would loose the env vars at the pipe which are set by aws-okta.

aws-okta exec gensandbox/dev -- sh -c 'printf "GroupA\n/GroupB\n/GroupC\n" | xargs -n 1 -P 20 saw watch --raw'

This should also work with a single log group in multiple regions like requested in the issue. Something along this:

printf "eu-central-1\n/ca-central-1\n/us-east-2\n" | xargs -n 1 -P 20 saw watch <log group> --raw --region