How to source as logStreamName using splunk-cloudwatch-logs-processor lambda blueprint?

[ehorwood]

Hi,

I've been trying to configure the Lambda function splunk-cloudwatch-logs-processor from the Splunk blog article: how-to-easily-stream-aws-cloudwatch-logs-to-splunk/

But when the logs are being pushed into splunk the source is either the lambda function name or lambda:undefined
Which means all of the logs from the LogGroup are pushed into one undefinable mess. Can't tell the difference between the LogStreams within the LogGroup.

I can use the following to edit the source as "test"

       logger.logEvent({
           time: item.timestamp, 
           event: item.message, 
           source: "test",
       });

But I want the source to be the logstreamname where the logs are getting pushed into splunk. Similar to how the Cloudwatch logs input on the AWS app works.
Something like:

           logger.logEvent({
               time: item.timestamp, 
               event: item.message, 
               source: item.logStreamName,
           });

But i've tried this and also parsed.logSteamName and various combinations of context.logStreamName /logStream/Stream etc.

Any help appreciated.

Thanks,

[gprice]

If you have logging enabled for your lambda function, you should be able to see the names of the fields available. When looking at them, remember it will be broken down by a header section and then a list of items. The context for item is limited to the scope of that log line, but the payload you are currently working in has a scope in the javascript of parsed. For my use case, I found that I was looking for parsed.logGroup to get the name of the log group as it appears in CloudWatch to appear as my source.

Hope this is still relevant to you, or others!

[dsenapaty]

@gprice this worked for me perfectly. thanks for your answer.