Monitor CloudWatch logs - print out warnings for logs that have large retention or size

app.py

import boto3
import json

# Warn if log retention is longer than 7 days
RETENTION_DAYS = 7

# Warn if log group is storing more than 1GB of data
STORED_BYTES = 1024 * 1024 * 1024

def print_warnings(log_groups):
    for l in log_groups:
        # bytes in human readable format
        storedBytes = "{:.2f} MB".format(l['storedBytes'] / (1024 * 1024))

        print("  {} ({} bytes, {} days)".format(l['logGroupName'], storedBytes, l.get('retentionInDays', 0)))

logs = boto3.client('logs')
response = logs.describe_log_groups()
log_groups = response['logGroups']

retention_warnings = [
    l for l in log_groups if l.get('retentionInDays') is None or l.get('retentionInDays', 0) > RETENTION_DAYS
]

retention_warnings = sorted(retention_warnings, key=lambda l: l.get('retentionInDays', 0), reverse=True)

stored_bytes_warnings = [
    l for l in log_groups if l['storedBytes'] > STORED_BYTES
]

stored_bytes_warnings = sorted(stored_bytes_warnings, key=lambda l: l['storedBytes'], reverse=True)

if retention_warnings:
    print("WARNING: Log groups with retention longer than {} days".format(RETENTION_DAYS))
    print_warnings(retention_warnings)

if stored_bytes_warnings:
    print("WARNING: Log groups with more than {} stored bytes".format(STORED_BYTES))
    print_warnings(stored_bytes_warnings)

requirements.txt

boto3