AWS Monitoring and notification using CloudWatch, Lambda, and SNS

				
					# Import the necessary libraries required for the python code.

import json 
import boto3 
import datetime
from datetime import datetime, timedelta
from dateutil.parser import parse
import time

def lambda_handler(event, context):
    try:

# Replace the values for the variables according to the actual infrastructure.

        logGroup  = '/aws/log_group'
        topicArn      = 'arn:aws:sns:us-east-1:123456789012:snstopic'
        subject       = 'Email Subject'
        queryString   = '?search keyword'
        notification  = True
        flag = True
        token=''
        
# t0 is the current time and t1 is 5 minutes before the current time.

        t0 = datetime.now()
        t1 = datetime.now() - timedelta(minutes=1)
        
# Convert the time in iso format

        def default(o):
            if isinstance(o, (datetime.date, datetime.datetime)):
                return o.isoformat()
                
# Convert the time to epoch format

        def convertToMil(value):
            dt_obj = datetime.strptime(str(value),'%Y%m%d%H%M%S')
            result = int(dt_obj.timestamp())
            return result
            
# Convert the time to human readable format

        def epoch2human(epoch):
          return time.strftime('%Y-%m-%d %H:%M:%S', 
                 time.localtime(int(epoch)/1000.0)) 
                 
# Assign start and end time for the query

        timestamp = t1.strftime("%Y%m%d%H%M%S")
        starttime = convertToMil(str(timestamp))
        currentdateTime = t0.strftime("%Y%m%d%H%M%S")
        endtime = convertToMil(str(currentdateTime))
        
# Filter the logs between the time window and containing the keyword

        client = boto3.client('logs')
        response = client.filter_log_events(
            logGroupName= logGroup,
            startTime=starttime*1000,
            endTime=endtime*1000,
            filterPattern=queryString,
            interleaved=True,
        )

# The queried result will be in JSON format. Hence Parse the result on order to read the contents.

        data = json.dumps(response, indent=2, default=default)
        parsed_data = json.loads(data)

# For the variable Message, assign the  value from the query result.

        message = [event["message"] for event in parsed_data["events"]]
        MESSAGE = [str(elem) for elem in message]

# If there is at least one log event matches the filter query then send email using SNS.
# If no logs events match the filter query, print “The list is empty”.

        snsClient= boto3.client('sns')
        if 'error' in data:
         response = snsClient.publish(
             TopicArn=topicArn,
             Message="The following log events contains errors:\n\n" + str(MESSAGE),
             Subject=subject,
             );
        else:
         print("The List is empty.")

# If the code is executed without any error, then print “Successfully executed the function “

        return {
            'StatusCode': 200,
            'Message': 'Successfully executed the function '
        }

# If code is exited due to any error, then print “Something went wrong, please investigate”

    except Exception as e:
        return {
            'StatusCode': 400,
            'Message': 'Something went wrong, Please Investigate. Error --> '+ str(e)
        }