5

我正在寻找一个 Cloudformation 模板来将 cloudwatch 日志推送到另一个帐户中的 elasticsearch。即使是同一个帐户也可以，我可以更新它。

似乎是一个标准问题，但还没有看到任何模板可以自动执行https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_ES_Stream.html中描述的步骤。

4

2 回答 2

3

我应该更新答案。这就是我写的，它是从 CW 到 Elastic Search 的流式日志的简约版本。

  Resources:
      LambdaElasticSearchExecutionRole:
          Properties:
            AssumeRolePolicyDocument:
              Statement:
              - Action: ['sts:AssumeRole']
                Effect: Allow
                Principal:
                  Service: [lambda.amazonaws.com]
              Version: '2012-10-17'
            Policies:
            - PolicyDocument:
                Statement:
                - Action: ['es:ESHttpPost']
                  Effect: Allow
                  Resource: "*"
                - Action: ['logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents']
                  Effect: Allow
                  Resource: "arn:aws:logs:*:*:*"
                - Action: ['lambda:InvokeFunction']
                  Effect: Allow
                  Resource: "arn:aws:logs:*:*:*"
                Version: '2012-10-17'
              PolicyName: lambdaRoleElasticSearchStreaming
          Type: AWS::IAM::Role

      ESStreamingLambda:
         Type: AWS::Lambda::Function
         DependsOn: LambdaElasticSearchExecutionRole
         Properties:
           Handler: index.handler
           Role:
             Fn::GetAtt: [LambdaElasticSearchExecutionRole, Arn]
           Code:
             S3Bucket: {'Fn::Sub': 'do-not-delete-cw-es-log-streaming-lamda-${AWS::Region}'}
             S3Key: LogsToElasticsearch.zip
           Runtime: nodejs4.3

      LambdaPermissionForCWInvokation:
         DependsOn: ESStreamingLambda
         Type: AWS::Lambda::Permission
         Properties:
          Action: lambda:InvokeFunction
          FunctionName:
            Fn::GetAtt: [ESStreamingLambda, Arn]
          Principal: {'Fn::Sub': 'logs.${AWS::Region}.amazonaws.com'}
  APILogsToElasticSearchSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    DependsOn: [ESStreamingLambda, LambdaPermissionForCWInvokation]
    Properties:
      DestinationArn:
        Fn::GetAtt: [ESStreamingLambda, Arn]
      FilterPattern: ''
      LogGroupName: {Ref: LambdaLogGroup}
```java
于 2018-11-21T09:25:01.507 回答
1

我目前正在尝试做同样的事情。我现在找到了这些例子：

于 2018-11-19T11:00:58.653 回答