Download log streams for a lambda in CloudWatch

get_lambda_logs.rb

require 'aws-sdk'

log_group_name = '/aws/lambda/LAMBDA-NAME'
log_stream_name_prefix = '2019/02/14'

client = Aws::CloudWatchLogs::Client.new(region: 'us-east-1')

response = client.describe_log_streams(log_group_name: log_group_name, log_stream_name_prefix: log_stream_name_prefix)
log_streams = response.log_streams.collect{ |log_stream| log_stream.log_stream_name + ':' + log_stream.creation_time.to_s }
while response.next_token
  response = client.describe_log_streams(log_group_name: log_group_name, log_stream_name_prefix: log_stream_name_prefix, next_token: response.next_token)
  log_streams += response.log_streams.collect{ |log_stream| log_stream.log_stream_name + ':' + log_stream.creation_time.to_s }
end
puts "Found #{log_streams.count} log streams."

path = log_group_name.gsub(/\//, '')
Dir.mkdir(path) unless Dir.exist?(path)

log_streams.each do |log_stream|
  log_stream_name, creation_time = log_stream.split(':')
  puts "Grabbing events for #{log_stream_name}."
  response = client.get_log_events(log_group_name: log_group_name, log_stream_name: log_stream_name)
  puts "Found #{response.events.count} events."

  messages = response.events.collect{ |event| event.message }.join

  filename = creation_time + '-' + log_stream_name.gsub(/\//, '-') + '.log'
  File.open(path + '/' + filename, 'w') { |f| f.write(messages) }
end

To join all of the streams into a single chronologically sorted list:

ruby get_lambda_logs.rb
cat awslambdaLAMBDA-NAME/*.log | grep -vE 'START|END|REPORT' | awk '{ print $2 " " substr($0, index($0,$4)) }' | sort -nk1 | less -S