How to send Fargate container logs to Papertrail?

[zulhfreelancer]

Hi @nathanpeck,

Do you have any resource on how to send/forward all logs from Fargate containers to Papertrail platform?

My organization is in the midst of migrating to AWS ECS Fargate (using CDK). We've been using Papertrail for few years and we want to keep it as our logging solution instead of CloudWatch. Appreciate if you can share some inputs for this.

Thanks.

[ianrodrigues]

Hi @zulhfreelancer ! At Petco, we've been using Sumo Logic as our logs solution. To do so, we use a Lambda function to get our logs from CloudWatch and send them to Sumo Logic. I guess there is a similar solution for seding logs to Papertrail:

https://help.papertrailapp.com/kb/hosting-services/amazon-cloudwatch/

[zulhfreelancer]

Hi @ianrodrigues. Thank you for sharing. Isn't that will skyrocket the cost because you will execute Lambda for every new log line you have? If you don't mind to share, how many log lines you have every month and how much you spent (in USD) for Lambda that cater the above task? Thanks.

[ianrodrigues]

Hey @zulhfreelancer, it all depends on your volume, so yes, it can skyrocket the cost. At Petco, we have 3 applications using that approach, here is our cost:

App 1 (Recently Enabled)

128 mb (Lambda Reserved Memory)
31419 (Lambda Executions per Month)
400 ms (Average Execution Duration)
= $0.03/month

App 2

128 mb (Lambda Reserved Memory)
277230 (Lambda Executions per Month)
400 ms (Average Execution Duration)
= $0.29/month

App 3

128 mb (Lambda Reserved Memory)
352490 (Lambda Executions per Month)
400 ms (Average Execution Duration)
= $0.36/month

Lambda is pretty cheap. You can check it here by yourself: https://s3.amazonaws.com/lambda-tools/#-calculator.html

[willhughes-au]

@zulhfreelancer

You write "Isn't that will skyrocket the cost because you will execute Lambda for every new log line you have?"

I would suggest doing some research on this.

From the Cloudwatch logs page, when it comes to sending logs to S3, you'll only get them every 5 minutes: "One or more log files are created every five minutes in the specified bucket."

If you want to get realtime log processing, you'd need to look at Cloudwatch Subscriptions.