In some cases, your CloudWatch logs may not match the format accepted by Microsoft Sentinel - .csv file in a GZIP format without a header. In this article, you use a lambda function (view the source code) within the Amazon Web Services (AWS) environment to send CloudWatch events to an S3 bucket, and convert the format to the accepted format.
Create a Lambda function to send CloudWatch events to an S3 bucket
Prerequisites
Create the lambda function
The lambda function uses Python 3.9 runtime and x86_64 architecture.
In the AWS Management Console, select the lambda service.
Select Create function.
Type a name for the function and select Python 3.9 as the runtime and x86_64 as the architecture.
Select Create function.
Under Choose a layer, select a layer and select Add.
Select Permissions, and under Execution role, select Role name.
Under Permissions policies, select Add permissions > Attach policies.
Search for the AmazonS3FullAccess and CloudWatchLogsReadOnlyAccess policies and attach them.
Return to the function, select Code, and paste the code link under Code source.
Fill the parameters as required.
Select Deploy, and then select Test.
Create an event by filling in the required fields.
Select Test to see how the event appears in the S3 bucket.
Povratne informacije
https://aka.ms/ContentUserFeedback.
Stiže uskoro: Tijekom 2024. postupno ćemo ukinuti servis Problemi sa servisom GitHub kao mehanizam za povratne informacije za sadržaj i zamijeniti ga novim sustavom za povratne informacije. Dodatne informacije potražite u članku:Pošaljite i pogledajte povratne informacije za