Skip to content

Lambda using this handler is forwarding logs from Cloudwatch multiple times #54

@nnixen

Description

@nnixen

Hi,
I'm writing AWS Lambda to forward logs from Cloudwatch to Splunk Cloud. Everything works, but when there is small amount of events (logs pushed to Cloudwatch loggroup) my lambda forwards them multiple times, sometimes 2, sometimes more. I'm positive I don't call this handler multiple times for the same event, so can it be something in the handler itself? I changed this bit of code to get parameters' substitution working like I needed it to do (function format_record()):

temp = json.loads(str(record.getMessage()))
        params = {
            'time': temp['_time'],
            'host': temp['_host'],
            'index': temp['_index'],
            'source': temp['_source'],
            'sourcetype': temp['_sourcetype'],
            'event': temp['event']
        }

Is it possible that it broke something and now handler workers are forwarding same logs multiple times? I make list of all Cloudwatch events and then iterate over it calling this handler:

for message in messages:
                logger.critical(message) 
                splunk.force_flush()

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions