How it works

Complexity: Simple | Infrastructure: Serverless | Latency: Event-driven

You deploy a Lambda function that triggers on events. When the logs are available, Lambda parses each format, adds labels, and forwards them to Grafana Cloud Logs.

Specific log types collected with Lambda

Log type	Format	Key insights
ALB Access Logs	Space-delimited	Request latency, targets, status codes
CloudFront Logs	Tab-separated	Edge locations, cache hits
S3 Access Logs	Space-delimited	Bucket access patterns
CloudTrail	JSON	API activity, audit

Considerations

Event-driven and automatic
Serverless, with no infrastructure to manage
Custom transformation of log data
Parsing configuration required for each log format
Cost that scales with log volume

Documentation

View the AWS Lambda logs documentation.

0:00

Read transcript

Audio transcript

The Lambda agent, also known as lambda-promtail, handles specific log types that Firehose doesn’t support yet.

Several AWS services write logs that need Lambda collection. ALB access logs give you HTTP request details: latency, status codes, which backend handled the request.

CloudFront logs show CDN performance: edge locations, cache hit rates.

CloudTrail logs every AWS API call: who did what, when, and from where.

Here’s how it works: you deploy a Lambda function that triggers on events. When these logs are available, Lambda processes them, parsing the format and adding labels, and then forwards them to Grafana Cloud Logs.

The beauty is serverless simplicity. No EC2 instances to patch, no containers to manage.

Lambda scales automatically with your log volume. You can customize the processing logic to fit your needs.

A few things to know: Lambda has execution costs, and you’ll need to configure parsing for each log format, since ALB logs are space-delimited, CloudFront is tab-separated, and CloudTrail is JSON.

How it works

Specific log types collected with Lambda

Considerations

Documentation

Still have questions?

Get every update