Tail an AWS CloudWatch Log Group

Question

I have a Log Group that includes several Log Streams (from several EC2 instances). Is there any way to simply "tail" the consolidated logs in the group? If I click "Search Events" that shows the consolidated logs but the button that jumps to the end of the logs is grayed out. I have to manually plug in the date and time. I also tried the aws cli, but aws logs get-log-events requires a single log stream name to be specified.

Answer 1

A couple of command tools for a CloudWatch tail:

• https://github.com/jorgebastida/awslogs
• https://github.com/liamoehlman/cloudwatch-logs-tail

Answer 2

This is now possible directly using AWS CLI v2. For example:

aws logs tail --since 1d --follow /aws/lambda/my_func

will tail and continuously watch CloudWatch logs from 1 day ago and forward into the future.

More here: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/logs/tail.html

Answer 3

I was really disappointed with awslogs and cloudwatch-logs-tail so I made my own tool called Saw that efficiently streams CloudWatch logs to the console (and colorizes the JSON output):

You can install it on MacOS with:

brew tap TylerBrock/saw
brew install saw

It has a bunch of nice features like the ability to automatically expand (indent) the JSON output (try running the tool with --expand):

saw watch my_log_group --expand

Got a Lambda you want to see error logs for? No Problem:

saw watch /aws/lambda/my_func --filter error 

Saw is great because the output is easily readable and you can stream logs from entire log group, not just a single stream in the group. Filtering and watching streams with a certain prefix is also just as easy!