How CloudWatch structures logs

Lambda automatically streams details about each function invocation, along with logs and other output from your function’s code to CloudWatch Logs.

Log groups are a standard part of CloudWatch and used to organize all logging. Any log generated by a Lambda function uses the naming convention /aws/lambda/function-name. A log group is a logical collection of log streams, which you can explore in the CloudWatch console:

Each instance of a Lambda function has a dedicated log stream. If a function scales up, each concurrent instance has its own log stream. Each time an execution environment is reaped and a new environment is created in response to an invocation, this generates a new log stream. The naming convention for log streams is:

YYYY/MM/DD[Function version][Execution environment GUID]

A single execution environment writes to the same log stream during its lifetime. The log stream contains messages from that execution environment and also any output from your Lambda function’s code. Every message is timestamped, including your custom logs, which means you do not need to output timestamps. Even if your function does not log any output from your code, there are three minimal log statements generated per invocation (START, END and REPORT):

These logs show:

• RequestId: this is a unique ID generated per request. If the Lambda function retries a request, this ID does not change and appears in the logs for each subsequent retry.

• Start/End: these bookmark a single invocation, so every log line between these belongs to the same invocation.

• Duration: the total invocation time for the handler function, excluding INIT code.

• Billed Duration: applies rounding logic for billing purposes.

• Memory Size: the amount of memory allocated to the function.

• Max Memory Used: the actual memory used during the invocation.

• Init Duration: the time taken to run the INIT section of code, outside of the main handler.