AWS Elastic Beanstalk：尽管有 IAM 权限和自定义配置，但自定义 Cloudwatch 日志未显示

Question

我在设置从 AWS Elastic Beanstalk 项目到 CloudWatch 的自定义日志文件流时遇到问题。作为参考，我尝试了“AWS Elastic Beanstalk：将自定义日志添加到 CloudWatch？”中的建议。无济于事。本质上，当我从主机下载日志时，我想要的日志文件位于/var/log/containers/api-1c080332ba3f-stdouterr.log、/var/log/containers/nginx-a5057f87f4cf-stdouterr.log和/var/log/containers/web-0a2e0762e8f0-stdouterr.log （其中数字在每次更新时都会更改）。

我添加了一个新的自定义日志配置文件.ebextensions/log.config（以下供参考）：

packages:
  yum:
    awslogs: []

files:
  "/etc/awslogs/awscli.conf" :
    mode: "000600"
    owner: root
    group: root
    content: |
      [plugins]
      cwlogs = cwlogs
      [default]
      region = `{"Ref":"AWS::Region"}`

  "/etc/awslogs/awslogs.conf" :
    mode: "000600"
    owner: root
    group: root
    content: |
      [general]
      state_file = /var/lib/awslogs/agent-state

  "/etc/awslogs/config/logs.conf" :
    mode: "000600"
    owner: root
    group: root
    content: |
      [/var/log/containers/nginx-stdouterr.log]
      log_group_name = `{"Fn::Join":["/", ["/aws/elasticbeanstalk", { "Ref":"AWSEBEnvironmentName" }, "var/log/containers/nginx-stdouterr.log"]]}`
      log_stream_name = {instance_id}
      file = /var/log/containers/nginx*

      [/var/log/containers/web-stdouterr.log]
      log_group_name = `{"Fn::Join":["/", ["/aws/elasticbeanstalk", { "Ref":"AWSEBEnvironmentName" }, "var/log/containers/web-stdouterr.log"]]}`
      log_stream_name = {instance_id}
      file = /var/log/containers/web*

      [/var/log/containers/api-stdouterr.log]
      log_group_name = `{"Fn::Join":["/", ["/aws/elasticbeanstalk", { "Ref":"AWSEBEnvironmentName" }, "var/log/containers/api-stdouterr.log"]]}`
      log_stream_name = {instance_id}
      file = /var/log/containers/api*

commands:
  "01":
    command: systemctl enable awslogsd.service
  "02":
    command: systemctl restart awslogsd

我还将此策略添加到了服务和 ec2 角色中：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:CreateLogGroup",
                "logs:PutLogEvents",
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

最后，我没有看到任何错误/var/logs/awslogs.log。

我还缺少其他部分吗？浏览了官方文档到目前为止还没有运气。

Answer 1

不要将您自己的策略添加到实例角色，而是尝试添加CloudWatchAgentServerPolicy托管策略。

当我的工作时，我还删除了/etc/awslogs/awslogs.conf文件定义。

最后，代理似乎仅在将行写入日志文件时才在 CloudWatch 中创建日志组。确保您正在收集的文件已被写入，并查看日志组是否已创建。祝你好运！