Forward a CloudWatch Logs log group to Logentries using a subscription filter and Lambda

logentries.cloudformation.yml

AWSTemplateFormatVersion: 2010-09-09

Parameters:
  LogGroupName:
    Type: String
  LogentriesLogToken:
    Type: String
    NoEcho: true

Resources:
  SendToLogentriesLambda:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: my-deployment-packages
        S3Key: logentries/r7insight_lambdaCW.zip
      Environment:
        Variables:
          region: eu
          token: !Ref LogentriesLogToken
      Handler: r7insight_lambdaCW.lambda_handler
      Role: !GetAtt LambdaRole.Arn
      Runtime: python2.7

  SubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      LogGroupName: !Ref LogGroupName
      FilterPattern: ""
      DestinationArn: !GetAtt SendToLogentriesLambda.Arn

  SendToLogentriesLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties: 
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt SendToLogentriesLambda.Arn
      Principal: logs.amazonaws.com

  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole