download-cloudwatch-log-events.sh

#!/bin/bash

# Script per scaricare i log da CloudWatch della AWS Console

home=`pwd`

# creo cartella tmp
mkdir -p .tmp

# scarico tutti i log-groups disponibili in formato JSON
aws logs describe-log-groups > .tmp/log-groups.json

if [ $? -ne 0 ]; then
  echo "Error downloading log-groups.json"
  exit 1
fi

# estraggo i log-groups e limetto in una lista
cat .tmp/log-groups.json | grep '"logGroupName":' | sed -e 's/[^"]*"logGroupName": "\([^"]*\)"[,]\?/\1/g' > .tmp/log-groups

if [ $? -ne 0 ]; then
  echo "Error parsing log-groups.json"
  exit 1
fi


for LOG_GROUP in `cat .tmp/log-groups`
do

  # elimino gli slash dal nome
  # groupname=`echo $LOG_GROUP | sed -e 's/\///1' | sed -e 's/[\/]\?\//-/g'`
  groupdir=`echo $LOG_GROUP | sed -e 's/\///1'`

  read -p "Download $LOG_GROUP log events? [N/y]" answer

  flag=`echo $answer|cut -c1|tr Y y`

  if [ 'y' = "$flag" ]; then

    mkdir -p $groupdir

    # scarico tutti i log-streams disponibili per il LOG_GROUP in formato JSON
    aws logs describe-log-streams --log-group-name $LOG_GROUP >> $groupdir/log-streams.json

    if [ $? -ne 0 ]; then
      echo "Error downloading log-streams.json"
      exit 1
    fi

    cd $groupdir

    # estraggo i log-streams e limetto in una lista
    cat log-streams.json | grep '"logStreamName":' | sed -e 's/[^"]*"logStreamName": "\([^"]*\)"[,]\?/\1/g' >> log-streams

    if [ $? -ne 0 ]; then
      echo "Error parsing log-streams.json"
      exit 1
    fi

    for LOG_STREAMS in `cat log-streams`
    do

       # elimino gli slash dal nome
      filename=`echo $LOG_STREAMS`

      # scarico tutti i log in formato JSON
      echo "aws logs get-log-events --log-group-name $LOG_GROUP --log-stream-name $LOG_STREAMS > $filename.json"
      aws logs get-log-events --log-group-name $LOG_GROUP --log-stream-name $LOG_STREAMS > $filename.json

      if [ $? -ne 0 ]; then
        echo "Error downloading $filename.json"
        exit 1
      fi

      # ricostruisco il formato standard dei log
      cat $filename.json | grep '"message":' | sed -e 's/[^"]*"message": "\([^"]*\)\\n"/\1/g' > $filename.log

      if [ $? -ne 0 ]; then
        echo "Error parsing $filename.json"
        exit 1
      fi

    done

    cd $home
  else
    echo "Skipped $LOG_GROUP"
  fi

done

# cancello la tmp
rm -rf .tmp