How to print the most recent Cloudwatch log for a certain Lambda function from the AWS CLI?

You can use aws logs describe-log-streams to get the latest stream name and then aws logs get-log-events to get the log records themselves.

LOG_GROUP=log-group
LOG_STREAM=`aws logs describe-log-streams --log-group-name $LOG_GROUP --max-items 1 --order-by LastEventTime --descending --query logStreams[].logStreamName --output text | head -n 1`
aws logs get-log-events --log-group-name $LOG_GROUP --log-stream-name $LOG_STREAM --query events[].message --output text

With latest AWS CLI you can also use tail.

aws logs tail $LOG_GROUP --follow

If someone is still struggling and want to extract the latest log stream using AWS CLI

aws logs describe-log-streams --log-group-name '/aws/lambda/ [YOUR_LAMBDA_FUNCTION_NAME_GOES_HERE]' --query 'logStreams[*].logStreamName' --max-items 1 --order-by LastEventTime --descending

Or You want to query all logs stream of single lambda you can use

aws logs describe-log-streams --log-group-name '/aws/lambda/[YOUR_LAMBDA_FUNCTION_NAME_GOES_HERE]' --query 'logStreams[*].logStreamName'

Using the log-type flag you'll be able to get the cloudwatch logs from the execution. For example:

LOG_RESULT=$(aws lambda invoke --function-name arn:aws:lambda:REGION:111122223333:function:YOUR_LAMBDA_NAME --log-type Tail outfile --query LogResult --output text)

echo $LOG_RESULT | base64 -D

OUTPUT:

START RequestId: 3ab54034-ed40-4fd7-b660-17db96a25f59 Version: $LATEST
END RequestId: 3ab54034-ed40-4fd7-b660-17db96a25f59
REPORT RequestId: 3ab54034-ed40-4fd7-b660-17db96a25f59  Duration: 71.48 ms  Billed Duration: 100 ms     Memory Size: 128 MB Max Memory Used: 74 MB

This assumes that the function is executed synchronously however with eventType RequestResponse.

If you still need the actual CloudWatch log from there you can query based on the request id.

REQUEST_ID=$(echo $LOG_RESULT | base64 -D | grep START | cut -d " " -f 3)
aws logs filter-log-events --log-group-name /aws/lambda/YOUR_LAMBDA_NAME --filter-pattern \"$REQUEST_ID\" 

OUTPUT:

{
    "events": [
        {
            "logStreamName": "2019/06/29/[$LATEST]f94a9c338ec445cda688c015b460621d",
            "timestamp": 1561775888037,
            "message": "START RequestId: 3ab54034-ed40-4fd7-b660-17db96a25f59 Version: $LATEST\n",
            "ingestionTime": 1561775888119,
            "eventId": "34828766136322027826299000340819150179641895561445048320"
        },
        {
            "logStreamName": "2019/06/29/[$LATEST]f94a9c338ec445cda688c015b460621d",
            "timestamp": 1561775888113,
            "message": "END RequestId: 3ab54034-ed40-4fd7-b660-17db96a25f59\n",
            "ingestionTime": 1561775903178,
            "eventId": "34828766138016884461387327717780753707358087734557278208"
        },
        {
            "logStreamName": "2019/06/29/[$LATEST]f94a9c338ec445cda688c015b460621d",
            "timestamp": 1561775888113,
            "message": "REPORT RequestId: 3ab54034-ed40-4fd7-b660-17db96a25f59\tDuration: 71.48 ms\tBilled Duration: 100 ms \tMemory Size: 128 MB\tMax Memory Used: 74 MB\t\n",
            "ingestionTime": 1561775903178,
            "eventId": "34828766138016884461387327717780753707358087734557278209"
        }
    ],
    "searchedLogStreams": [
        {
            "logStreamName": "2019/06/29/[$LATEST]f94a9c338ec445cda688c015b460621d",
            "searchedCompletely": true
        }
    ]
}

However, this output is not in order and includes the information about the log stream itself and which log groups were searched.

You can filter it using this command then:

aws logs filter-log-events --log-group-name /aws/lambda/YOUR_LAMBDA_NAME --filter-pattern \"$REQUEST_ID\" --query 'sort_by(events, &timestamp)[*].[message]' | jq .[][0]

OUTPUT:

"START RequestId: 610dcebf-bb7b-4c39-895b-8989b46386a8 Version: $LATEST\n"
"END RequestId: 610dcebf-bb7b-4c39-895b-8989b46386a8\n"
"REPORT RequestId: 610dcebf-bb7b-4c39-895b-8989b46386a8\tDuration: 154.04 ms\tBilled Duration: 200 ms \tMemory Size: 128 MB\tMax Memory Used: 73 MB\t\n"

There are a couple of useful open source tools than can help:

• jorgebastida/awslogs
• TylerBrock/saw