Introduction

I checked the contents of the CloudWatch Logs agent (halfway). I looked it up. I will proceed on the assumption that I have read the above blog.

Conclusion

/var/awslogs/lib/python2.7/site-packages/cwlogs/push.py

Was the code that reads the monitored logs and pushes the event to the CloudWatch Logs service. It's about 1800 lines of code. It's hard for me to read it, but the main processing is completed in this code, so you can read it to see how it works. FileEventsReader._run (self) is the part that actually reads the log

The future is a digression.

awscli does not contain logs code

Because it is included in aws cli,

/usr/lib/python2.7/dist-packages/awscli  (awscli installation directory)
https://github.com/aws/aws-cli  (awscli git repository)
https://github.com/boto/boto3/  (Library used by awscli)

I searched for subordinates, but there was nothing.

Cloudwatch logs agent execution process

I turned around and looked at the runtime options for the cloudwatch logs agent. /var/awslogs/bin/awslogs-agent-launcher.sh Looking at, it is as follows.

/usr/bin/env -i \
HTTPS_PROXY=$HTTPS_PROXY \
HTTP_PROXY=$HTTP_PROXY \
NO_PROXY=$NO_PROXY \
AWS_CONFIG_FILE=/var/awslogs/etc/aws.conf \
HOME=/root \
/bin/nice -n 4 \
/var/awslogs/bin/aws logs push \
--config-file /var/awslogs/etc/awslogs.conf \
--additional-configs-dir /var/awslogs/etc/config \
>> /var/log/awslogs.log 2>&1

When I actually executed this command while erasing the setting, it worked if there was the following

AWS_CONFIG_FILE=/var/awslogs/etc/aws.conf \
/var/awslogs/bin/aws logs push \
--config-file /var/awslogs/etc/awslogs.conf

Looking at the contents of AWS_CONFIG_FILE, it is as follows.

$ cat /var/awslogs/etc/aws.conf
[plugins]
cwlogs = cwlogs
[default]
region = us-west-2

awscli plugin

Oh. Plugin! So if you look for a python package /var/awslogs/lib/python2.7/site-packages/cwlogs Exists and has the following files

filter.py
__init__.py
kvstore.py
parser.py
pull.py
push.py
retry.py
threads.py
utils.py

Of these, push.py and pull.py were commands and the rest were utility classes. I haven't investigated the function of pull because I have no guts.

in conclusion

For the first time, I learned that AWS CLI can add functionality with plugins. I think it may be possible to create a plugin by referring to cwlogs.

reference

I checked the contents of the CloudWatch Logs agent (halfway) Summary of research on the behavior of CloudWatch Logs Agent

I searched for the contents of CloudWatch Logs Agent