How to configure log shipper for Cloudwatch (and your Lambda) using AWS CDK


You have your Lambda on AWS. Now you want to view the logs in Cloudwatch and you probably know this is not the most pleasant thing to do. But wait, there are things like - an ELK service that makes viewing logs a breeze. Let’s see how to connect log shipper that will push your Lambda logs from cloudwatch to their ELK stack. shipper lambda

Let’s start with a Shipper Lambda CDK code:

package com.piotrnowicki.cdk;

import software.constructs.Construct;

import java.util.Map;

public class LogzioForwarderLambda extends Construct {

    private static final Map<String, String> CONFIG = Map.of(
            "TOKEN", System.getenv("LOGZIO_TOKEN"),
            "REGION", "EU",
            "TYPE", "logzio_cloudwatch_lambda",
            "FORMAT", "json");

    private static final int MEMORY = 512;
    private static final Duration TIMEOUT = Duration.seconds(60);

    private final Function function;

    public LogzioForwarderLambda(Construct scope, String functionName) {
        super(scope, "LogzIoShipperLambda");
        this.function = createFunction(functionName);

    Function createFunction(String functionName) {
        return Function.Builder.create(this, functionName)

    public Function getFunction() {
        return this.function;

LOGZIO_TOKEN is the env-var that we need to pass to CDK (e.g. from CI/CD pipeline).

The mentioned is a ZIP file produced by invoking following code (taken from the official docs):

git clone \
&& cd logzio_aws_serverless/python3/cloudwatch/ \
&& mkdir -p dist/python3/shipper; cp -r ../shipper/ dist/python3/shipper \
&& cp src/ dist \
&& cd dist/ \
&& zip logzio-cloudwatch python3/shipper/*

CDK Stack using shipper

Here is a sample CDK stack that is using the freshly defined shipper:


import software.constructs.Construct;

import static;
import static;

public class QuarkusStack extends Stack {

    public QuarkusStack(Construct construct, String id) {
        super(construct, id + "-quarkus-stack");

        QuarkusLambda quarkusLambda = new QuarkusLambda(this, APP_NAME + "-function");

        LogzioForwarderLambda logzioShipper = new LogzioForwarderLambda(this, APP_NAME + "-cloudwatch-forwarder");

        SubscriptionFilter.Builder.create(this, APP_NAME + "-cloudwatch-trigger")


The QuarkusLambda is a separate construct that represents business-code Lambda we want to ship logs to

The whole magic happens in the SubscriptionFilter that is binding the logGroup created implicitly when we create a Lambda ( with the log shipper.


This quick sample shows how to create lambda that ships the logs from given Cloudwatch log group and forwards it to the for easier processing.