amazon-web-services - Cloudwatch 日志警报 - 如何在电子邮件通知中包含错误/异常/堆栈跟踪数据

Question

我刚刚在我的 ec2 实例上配置了 Cloudwatch 日志，到目前为止我很喜欢它。我还为某些关键字设置了警报，例如“错误”。虽然电子邮件警报似乎工作正常，但我想知道是否有一种方法可以微调警报电子邮件，使其更加简洁和信息丰富。具体来说，我正在寻找

删除警报电子邮件中的所有样板文本。

包括一些有关触发警报的错误/异常的信息。这可能就像包含生成警报的日志语句一样简单。

现在，警报电子邮件看起来像

You are receiving this email because your Amazon CloudWatch Alarm "App-Error-Alarm" in the US East - N. Virginia region has entered the ALARM state, because "Threshold Crossed: 1 datapoint (1.0) was greater than or equal to the threshold (1.0)." at "Tuesday 07 February, 2017 16:39:43 UTC".

View this alarm in the AWS Management Console: https://console.aws.amazon.com/cloudwatch/home?region=us-east-1#s=Alarms&alarm=App-Error-Alarm

Alarm Details: - Name: App-Error-Alarm - Description: Errors in app.log - State Change: INSUFFICIENT_DATA -> ALARM - Reason for State Change: Threshold Crossed: 1 datapoint (1.0) was greater than or equal to the threshold (1.0). - Timestamp: Tuesday 07 February, 2017 16:39:43 UTC - AWS Account: <>

Threshold: - The alarm is in the ALARM state when the metric is GreaterThanOrEqualToThreshold 1.0 for 300 seconds.

Monitored Metric: - MetricNamespace: LogMetrics - MetricName: ERROR - Dimensions: - Period: 300 seconds - Statistic: Sum - Unit: not specified

State Change Actions: - OK: - ALARM: [arn:aws:sns:us-east-1:<>:support] - INSUFFICIENT_DATA:

我想要类似的东西

Alarm: App-Error-Alarm

Keyword: "ERROR"

Reason: ERROR 2017-02-07 07:31:47,375 [SimpleAsyncTaskExecutor-5] com.app.server.rest.Watcher: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

它的简短、甜蜜并立即告诉我它是否需要我立即关注。是否可以不按照建议编写代码来完成此操作 here ?

Answer 1

您遇到此问题是因为您配置了一个警报并且用于汇总数据，而不是用于特定的日志记录。您将其配置为某些指标(带有 ERROR 关键字的日志记录数)。

您可以改用日志订阅，并将与过滤器匹配的所有日志记录流式传输到自定义 Lambda 函数。您可以使用它向电子邮件或 Slack 发送通知。

要配置日志流，请转到 AWS 控制台中的 Lambda 并从名为 的蓝图创建一个新函数。 "cloudwatch-logs-process-data" .它具有基本结构，易于根据您的需要进行定制。