|
| 1 | +--- |
| 2 | +title: AWS Lambda Integration Guide |
| 3 | +description: Stream AWS Lambda logs directly into OpenObserve using the Lambda Extension, bypassing CloudWatch. |
| 4 | +--- |
| 5 | + |
| 6 | +# Integration with AWS Lambda Extension |
| 7 | + |
| 8 | +This guide explains how to stream **AWS Lambda logs directly to OpenObserve** using the OpenObserve Lambda Extension. |
| 9 | +With this integration, you can bypass CloudWatch, reduce costs, and achieve **real-time observability** for serverless workloads. |
| 10 | + |
| 11 | +## Overview |
| 12 | + |
| 13 | +The [OpenObserve Lambda Extension](https://github.com/openobserve/openobserve-lambda-extension) runs alongside your Lambda function and forwards logs directly to OpenObserve. |
| 14 | +This eliminates the need to store or process logs in CloudWatch, while still giving you centralized log analysis, dashboards, and alerts in OpenObserve. |
| 15 | + |
| 16 | +{:style="height:300px"} |
| 17 | + |
| 18 | +## Steps to Integrate |
| 19 | + |
| 20 | +??? "Prerequisites" |
| 21 | + - OpenObserve account ([Cloud](https://cloud.openobserve.ai/web/) or [Self-Hosted](../../../quickstart/#self-hosted-installation)) |
| 22 | + - AWS account with: |
| 23 | + - A Lambda function |
| 24 | + - IAM permissions to update environment variables and layers |
| 25 | + - AWS CLI installed and configured |
| 26 | + |
| 27 | +??? "Step 1: Check Your Lambda Architecture" |
| 28 | + You can check your Lambda architecture using the command: |
| 29 | + |
| 30 | + ``` |
| 31 | + aws lambda get-function-configuration --function-name <function_name> --query 'Architectures' |
| 32 | + ``` |
| 33 | +  |
| 34 | + Based on the returned architecture (x86_64 or arm64), copy the compatible ARN values for the OpenObserve Lambda Extension layer. |
| 35 | + |
| 36 | + - For x86_64: `arn:aws:lambda:<aws_region_id>:325553860333:layer:openobserve-extension-x86_64:1` |
| 37 | + - For arm64: `arn:aws:lambda:<aws_region_id>:325553860333:layer:openobserve-extension-arm64:1` |
| 38 | + |
| 39 | + > Note: Make sure <aws_region_id> matches the region where your Lambda function is deployed, as Lambda layers are regional. Using an ARN from a different region will not work. |
| 40 | + |
| 41 | +??? "Step 2: Add OpenObserve Lambda Extension Layer" |
| 42 | + |
| 43 | + 1. In AWS Lambda console, open your target function |
| 44 | +  |
| 45 | + 2. Go to **Layers → Add a Layer** |
| 46 | +  |
| 47 | + 3. Choose “Specify an ARN” and Paste the ARN you got from Step 1 |
| 48 | +  |
| 49 | + 4. Save the changes |
| 50 | + |
| 51 | +??? "Step 3: Configure Environment Variables" |
| 52 | + |
| 53 | + 1. Go to your Lambda function → Configuration tab → Environment variables |
| 54 | + 2. Add the following environment variables in your Lambda function: |
| 55 | + |
| 56 | + | Key | Value Example | |
| 57 | + |---------------------------|----------------------------------------------| |
| 58 | + | `O2_ENDPOINT` | `https://<your-domain>:5080` | |
| 59 | + | `O2_AUTHORIZATION_HEADER` | `Basic <your-api-key>` | |
| 60 | + | `O2_ORGANIZATION_ID` | `<your-org-id>` | |
| 61 | + | `O2_STREAM` | `<stream_name>` | |
| 62 | + |
| 63 | + > Note: You can fetch these credentials from OpenObserve UI, Go to Data Sources -> Logs -> OTEL Collector |
| 64 | + |
| 65 | +  |
| 66 | + |
| 67 | + > Security Note: Use AWS Secrets Manager to store credentials like O2_AUTHORIZATION_HEADER securely. |
| 68 | + |
| 69 | +??? "Step 4: Invoke the Function" |
| 70 | + Invoke the function to generate some logs |
| 71 | + ``` |
| 72 | + aws lambda invoke \ |
| 73 | + --function-name <function-name>\ |
| 74 | + response.json |
| 75 | + ``` |
| 76 | + |
| 77 | +??? "Step 5: Verify Logs in OpenObserve" |
| 78 | + |
| 79 | + 1. Go to **Logs** in OpenObserve -> Select your log stream. |
| 80 | + 2. Set a recent time range and click **Run Query** |
| 81 | +  |
| 82 | + 3. Filter out on logs where type= function using SQL query: |
| 83 | + ``` |
| 84 | + SELECT * FROM "<log-stream>" where type = 'function' |
| 85 | + ``` |
| 86 | +  |
| 87 | + |
| 88 | + |
| 89 | + |
| 90 | +## Troubleshooting |
| 91 | + |
| 92 | +**Not seeing logs in OpenObserve?** |
| 93 | + |
| 94 | +- **Stream mismatch** |
| 95 | + Ensure the `O2_STREAM` environment variable matches the stream configured in OpenObserve. |
| 96 | + |
| 97 | +- **Missing/incorrect environment variables** |
| 98 | + Double-check `O2_ENDPOINT`, `O2_AUTHORIZATION_HEADER`, and `O2_ORGANIZATION_ID`. |
| 99 | + |
| 100 | +- **Architecture mismatch** |
| 101 | + Function runs but extension does not load if the wrong layer architecture is used. Verify with `aws lambda get-function-configuration`. |
| 102 | + |
| 103 | +!!! tip "Bypass CloudWatch Logging" |
| 104 | + |
| 105 | + To ensure logs only flow to OpenObserve, remove these IAM permissions from the Lambda role: |
| 106 | + |
| 107 | + - `logs:CreateLogGroup` |
| 108 | + - `logs:CreateLogStream` |
| 109 | + - `logs:PutLogEvents` |
| 110 | + |
| 111 | + |
| 112 | +## Next Steps |
| 113 | + |
| 114 | +Once logs are flowing into OpenObserve, you can: |
| 115 | + |
| 116 | +- **Build [dashboards](../../user-guide/dashboards/index.md)** around function latency, memory usage, and errors |
| 117 | +- **Set up [alerts](../../user-guide/alerts/alerts.md)** on anomalies or failures |
| 118 | + |
| 119 | + |
0 commit comments